diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2022-03-08 04:20:47 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2022-03-08 04:20:47 +0000 |
| commit | 0c5a5155ba6da26c4e15acac9c182847add842e5 (patch) | |
| tree | 3637ca5f672ac73cef00422649204cb608387c13 | |
| parent | b13983489ef03f24c71b895c71418e97a5ecfbcb (diff) | |
| parent | 6534797a8d7b9ffaf4cd5d618a7b656cd3df8091 (diff) | |
| download | bt-0c5a5155ba6da26c4e15acac9c182847add842e5.tar.gz | |
Merge "Fix OOB of L2CAP_CMD_CREDIT_BASED_CONN_RES" into sc-dev am: 4388d1fe69 am: 6534797a8d
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/16816453
Change-Id: Id06963e52622e0d49608cb7737ede634384a4b6b
| -rw-r--r-- | stack/l2cap/l2c_ble.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc index 16454a5b0..d5486794d 100644 --- a/stack/l2cap/l2c_ble.cc +++ b/stack/l2cap/l2c_ble.cc @@ -621,7 +621,7 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) { break; } case L2CAP_CMD_CREDIT_BASED_CONN_RES: - if (p + 2 > p_pkt_end) { + if (p + 8 > p_pkt_end) { LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len"; return; } |