Merge "Add bounds check for BNEP_Write" into pi-dev (e36917c1) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/bnep/bnep_api.cc

+2 −0

Original line number	Diff line number	Diff line
		@@ -378,6 +378,7 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr,
		protocol = 0;
		else {
		new_len += 4;
		if (new_len > org_len) return BNEP_IGNORE_CMD;
		p_data[2] = 0;
		p_data[3] = 0;
		}
		@@ -474,6 +475,7 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr,
		protocol = 0;
		else {
		new_len += 4;
		if (new_len > org_len) return BNEP_IGNORE_CMD;
		p_data[2] = 0;
		p_data[3] = 0;
		}