diff options
| author | Hansong Zhang <hsz@google.com> | 2018-07-13 13:45:46 -0700 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2018-11-18 07:45:39 +0000 |
| commit | dab3cc747a5b073b4eac6a73719b97fe217afb5f (patch) | |
| tree | da5fd6f44470a02953f1d8254303fd6d011a8b1c | |
| parent | 9aec9a237b8af2b5895385c188e36d662322edd3 (diff) | |
| download | android_system_bt-dab3cc747a5b073b4eac6a73719b97fe217afb5f.tar.gz android_system_bt-dab3cc747a5b073b4eac6a73719b97fe217afb5f.tar.bz2 android_system_bt-dab3cc747a5b073b4eac6a73719b97fe217afb5f.zip | |
Fix a wrong check in rfc_parse_data
Bug: 78288018
Bug: 111436796
Test: manual
Change-Id: I16e6026acbaac230fe1453bbac040d1b75bcea2a
(cherry picked from commit d1ced302cd1066087588c891027b1756be31db46)
| -rw-r--r-- | stack/rfcomm/rfc_ts_frames.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stack/rfcomm/rfc_ts_frames.c b/stack/rfcomm/rfc_ts_frames.c index c234430c8..8a83e429b 100644 --- a/stack/rfcomm/rfc_ts_frames.c +++ b/stack/rfcomm/rfc_ts_frames.c @@ -605,7 +605,7 @@ UINT8 rfc_parse_data (tRFC_MCB *p_mcb, MX_FRAME *p_frame, BT_HDR *p_buf) eal = *(p_data)&RFCOMM_EA; len = *(p_data)++ >> RFCOMM_SHIFT_LENGTH1; - if (eal == 0 && p_buf->len < RFCOMM_CTRL_FRAME_LEN) + if (eal == 0 && p_buf->len > RFCOMM_CTRL_FRAME_LEN) { len += (*(p_data)++ << RFCOMM_SHIFT_LENGTH2); } |