diff options
-rw-r--r-- | stack/l2cap/l2c_main.c | 44 | ||||
-rw-r--r-- | stack/l2cap/l2c_utils.c | 3 |
2 files changed, 37 insertions, 10 deletions
diff --git a/stack/l2cap/l2c_main.c b/stack/l2cap/l2c_main.c index 0ef1fbb6e..379d7608e 100644 --- a/stack/l2cap/l2c_main.c +++ b/stack/l2cap/l2c_main.c @@ -573,7 +573,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) { case L2CAP_CFG_TYPE_MTU: cfg_info.mtu_present = TRUE; - if (p + 2 > p_next_cmd) { + if (cfg_len != 2) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -582,7 +586,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_FLUSH_TOUT: cfg_info.flush_to_present = TRUE; - if (p + 2 > p_next_cmd) { + if (cfg_len != 2) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -591,9 +599,13 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_QOS: cfg_info.qos_present = TRUE; - if (p + 2 + 5 * 4 > p_next_cmd) { - android_errorWriteLog(0x534e4554, "74202041"); - return; + if (cfg_len != 2 + 5 * 4) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { + android_errorWriteLog(0x534e4554, "74202041"); + return; } STREAM_TO_UINT8 (cfg_info.qos.qos_flags, p); STREAM_TO_UINT8 (cfg_info.qos.service_type, p); @@ -606,9 +618,13 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_FCR: cfg_info.fcr_present = TRUE; - if (p + 3 + 3 * 2 > p_next_cmd) { - android_errorWriteLog(0x534e4554, "74202041"); - return; + if (cfg_len != 3 + 3 * 2) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { + android_errorWriteLog(0x534e4554, "74202041"); + return; } STREAM_TO_UINT8 (cfg_info.fcr.mode, p); STREAM_TO_UINT8 (cfg_info.fcr.tx_win_sz, p); @@ -620,7 +636,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_FCS: cfg_info.fcs_present = TRUE; - if (p + 1 > p_next_cmd) { + if (cfg_len != 1) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -629,7 +649,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_EXT_FLOW: cfg_info.ext_flow_spec_present = TRUE; - if (p + 2 + 2 + 3 * 4 > p_next_cmd) { + if (cfg_len != 2 + 2 + 3 * 4) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } diff --git a/stack/l2cap/l2c_utils.c b/stack/l2cap/l2c_utils.c index 2c33c7135..d793f8759 100644 --- a/stack/l2cap/l2c_utils.c +++ b/stack/l2cap/l2c_utils.c @@ -878,6 +878,9 @@ void l2cu_send_peer_config_rej (tL2C_CCB *p_ccb, UINT8 *p_data, UINT16 data_len, case L2CAP_CFG_TYPE_MTU: case L2CAP_CFG_TYPE_FLUSH_TOUT: case L2CAP_CFG_TYPE_QOS: + case L2CAP_CFG_TYPE_FCR: + case L2CAP_CFG_TYPE_FCS: + case L2CAP_CFG_TYPE_EXT_FLOW: p_data += cfg_len + L2CAP_CFG_OPTION_OVERHEAD; break; |