Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fab4a492 authored by Chienyuan's avatar Chienyuan
Browse files

Fix OOB in hidd_l2cif_data_ind 

Bug: 109753657
Test: manual
Change-Id: I3bcd369dc34df926f88345c83f10a96ec6566882
parent 91c25d06

system/stack/hid/hidd_conn.cc

+6 −0
Original line number Diff line number Diff line
@@ -614,6 +614,12 @@ static void hidd_l2cif_data_ind(uint16_t cid, BT_HDR* p_msg) { 


  HIDD_TRACE_EVENT("%s: cid=%04x", __func__, cid);



  if (p_msg->len < 1) {

    HIDD_TRACE_ERROR("Invalid data length, ignore");

    osi_free(p_msg);

    return;

  }



  p_hcon = &hd_cb.device.conn;



  if (p_hcon->conn_state == HID_CONN_STATE_UNUSED ||