diff options
| author | Pavlin Radoslavov <pavlin@google.com> | 2017-07-17 16:03:21 -0700 |
|---|---|---|
| committer | Andreas Blaesius <skate4life@gmx.de> | 2017-09-17 22:11:30 +0200 |
| commit | 5a439513c7001b77a63e6910189e3dcc1539ee1e (patch) | |
| tree | 49271040df55e281566bf76f74ff6a658311c60b | |
| parent | bee52c2d82153fa6459b31922c332b80bcc8a5ee (diff) | |
| download | android_system_bt-5a439513c7001b77a63e6910189e3dcc1539ee1e.tar.gz android_system_bt-5a439513c7001b77a63e6910189e3dcc1539ee1e.tar.bz2 android_system_bt-5a439513c7001b77a63e6910189e3dcc1539ee1e.zip | |
Add missing extension length check while parsing BNEP control packets
Bug: 63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit 9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit dc7700a43189d2a8607b69ae19a6d646f11ddf51)
CVE-2017-0782
| -rw-r--r-- | stack/bnep/bnep_utils.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c index 777ac776d..a9987cf8b 100644 --- a/stack/bnep/bnep_utils.c +++ b/stack/bnep/bnep_utils.c @@ -915,7 +915,7 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len BNEP_TRACE_ERROR("%s: BNEP - bad ctl pkt type: %d", __func__, control_type); bnep_send_command_not_understood (p_bcb, control_type); - if (is_ext) + if (is_ext && (ext_len > 0)) { if (*rem_len < (ext_len - 1)) { |