diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2018-10-19 16:24:56 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-10-19 16:24:56 +0000 |
commit | 753614f69320999f417b1ed78cd030f7a9365559 (patch) | |
tree | 65c31fa24d0f1b0d6ecc94db061ec1ea29bf758c | |
parent | 55343c265a2e94f855f4c7a882063673040a2a86 (diff) | |
parent | 314336a22d781f54ed7394645a50f74d6743267d (diff) | |
download | bt-oreo-m7-release.tar.gz |
Merge cherrypicks of [5313339, 5313437, 5313318, 5313340, 5313282, 5313283, 5313438, 5313284, 5313341, 5313379, 5313380, 5313319, 5313320, 5313321, 5313285, 5313286, 5313287, 5313497, 5313439] into oc-m7-releaseandroid-8.1.0_r52oreo-m7-release
Change-Id: I22d0e4c83319fde9ad259a5d3b39cc9712c9582a
-rw-r--r-- | stack/l2cap/l2c_fcr.cc | 8 | ||||
-rw-r--r-- | stack/sdp/sdp_discovery.cc | 11 |
2 files changed, 19 insertions, 0 deletions
diff --git a/stack/l2cap/l2c_fcr.cc b/stack/l2cap/l2c_fcr.cc index 9c2742f56..903009684 100644 --- a/stack/l2cap/l2c_fcr.cc +++ b/stack/l2cap/l2c_fcr.cc @@ -842,6 +842,14 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { return; } + if (sdu_length < p_buf->len) { + L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length); + android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0); + /* Discard the buffer */ + osi_free(p_buf); + return; + } + p_data = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE); if (p_data == NULL) { osi_free(p_buf); diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc index b0b4dc7c9..974c02e73 100644 --- a/stack/sdp/sdp_discovery.cc +++ b/stack/sdp/sdp_discovery.cc @@ -277,6 +277,11 @@ static void process_service_search_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, uint16_t total, cur_handles, orig; uint8_t cont_len; + if (p_reply + 8 > p_reply_end) { + android_errorWriteLog(0x534e4554, "74249842"); + sdp_disconnect(p_ccb, SDP_GENERIC_ERROR); + return; + } /* Skip transaction, and param len */ p_reply += 4; BE_STREAM_TO_UINT16(total, p_reply); @@ -295,6 +300,12 @@ static void process_service_search_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, if (p_ccb->num_handles > sdp_cb.max_recs_per_search) p_ccb->num_handles = sdp_cb.max_recs_per_search; + if (p_reply + ((p_ccb->num_handles - orig) * 4) + 1 > p_reply_end) { + android_errorWriteLog(0x534e4554, "74249842"); + sdp_disconnect(p_ccb, SDP_GENERIC_ERROR); + return; + } + for (xx = orig; xx < p_ccb->num_handles; xx++) BE_STREAM_TO_UINT32(p_ccb->handles[xx], p_reply); |