diff options
| author | Pavlin Radoslavov <pavlin@google.com> | 2017-07-06 13:39:02 -0700 |
|---|---|---|
| committer | Andreas Blaesius <skate4life@gmx.de> | 2017-09-17 22:11:26 +0200 |
| commit | 2bb37becb8efe5ba92f2804cf091bde33c8290d4 (patch) | |
| tree | 4aa8a480a4be21d1c1f78ca6ec19feed4ef5c313 /stack/l2cap | |
| parent | 27eaaa6e0a490c357411196938a913c958020b39 (diff) | |
| download | android_system_bt-2bb37becb8efe5ba92f2804cf091bde33c8290d4.tar.gz android_system_bt-2bb37becb8efe5ba92f2804cf091bde33c8290d4.tar.bz2 android_system_bt-2bb37becb8efe5ba92f2804cf091bde33c8290d4.zip | |
Allocate buffers of the right size when BT_HDR is included
Bug: 63146105
Test: External script
Change-Id: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
Merged-In: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
(cherry picked from commit 8810ffba990f8f53172c445ebde8707525bb7813)
CVE-2017-0781
Diffstat (limited to 'stack/l2cap')
| -rw-r--r-- | stack/l2cap/l2cap_client.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/stack/l2cap/l2cap_client.c b/stack/l2cap/l2cap_client.c index 95b8e0131..e4c7d82f6 100644 --- a/stack/l2cap/l2cap_client.c +++ b/stack/l2cap/l2cap_client.c @@ -372,7 +372,7 @@ static void fragment_packet(l2cap_client_t *client, buffer_t *packet) { assert(packet != NULL); // TODO(sharvil): eliminate copy into BT_HDR. - BT_HDR *bt_packet = GKI_getbuf(buffer_length(packet) + L2CAP_MIN_OFFSET); + BT_HDR *bt_packet = GKI_getbuf(buffer_length(packet) + L2CAP_MIN_OFFSET + sizeof(BT_HDR)); bt_packet->offset = L2CAP_MIN_OFFSET; bt_packet->len = buffer_length(packet); memcpy(bt_packet->data + bt_packet->offset, buffer_ptr(packet), buffer_length(packet)); @@ -386,7 +386,7 @@ static void fragment_packet(l2cap_client_t *client, buffer_t *packet) { break; } - BT_HDR *fragment = GKI_getbuf(client->remote_mtu + L2CAP_MIN_OFFSET); + BT_HDR *fragment = GKI_getbuf(client->remote_mtu + L2CAP_MIN_OFFSET + sizeof(BT_HDR)); fragment->offset = L2CAP_MIN_OFFSET; fragment->len = client->remote_mtu; memcpy(fragment->data + fragment->offset, bt_packet->data + bt_packet->offset, client->remote_mtu); |