Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9952e04 authored by Ugo Yu's avatar Ugo Yu
Browse files

DO NOT MERGE - Check SDU lower bound before allocate p_data 

Bug: 112321180
Test: SL4A BleCocTest:test_coc_insecured_connection_write_ascii
Change-Id: Id0c9aa2097f0b6bdc2bb9fa9086daa9452188e1d
parent ea9f3059

system/stack/l2cap/l2c_fcr.cc

+9 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
 ******************************************************************************/



#include <base/logging.h>

#include <log/log.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>
@@ -841,6 +842,14 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
      return;

    }



    if (sdu_length < p_buf->len) {

      L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);

      android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);

      /* Discard the buffer */

      osi_free(p_buf);

      return;

    }



    p_data = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE);

    if (p_data == NULL) {

      osi_free(p_buf);