Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e4876825 authored by Ajay Panicker's avatar Ajay Panicker Committed by android-build-merger
Browse files

Merge "Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ" into... 

Merge "Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ" into oc-dev am: 3b431747 am: 2dce956a
am: a2c3fb48

Change-Id: I83ccedc2c4a6e36e66c0b398db8e2578e3c379a6
parents 33303ba1 a2c3fb48

system/stack/l2cap/l2c_ble.cc

+5 −0
Original line number Original line Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include "hcimsgs.h"

#include "hcimsgs.h"

#include "l2c_int.h"

#include "l2c_int.h"

#include "l2cdefs.h"

#include "l2cdefs.h"

#include "log/log.h"

#include "osi/include/osi.h"

#include "osi/include/osi.h"

#include "stack_config.h"

#include "stack_config.h"
@@ -811,6 +812,10 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) { 
      break;

      break;





    case L2CAP_CMD_DISC_REQ:

    case L2CAP_CMD_DISC_REQ:

      if (p + 4 > p_pkt_end) {

        android_errorWriteLog(0x534e4554, "74121659");

        return;

      }

      STREAM_TO_UINT16(lcid, p);

      STREAM_TO_UINT16(lcid, p);

      STREAM_TO_UINT16(rcid, p);

      STREAM_TO_UINT16(rcid, p);