diff options
| author | Pavlin Radoslavov <pavlin@google.com> | 2017-07-06 13:39:02 -0700 |
|---|---|---|
| committer | Andreas Blaesius <skate4life@gmx.de> | 2017-09-17 22:11:26 +0200 |
| commit | 2bb37becb8efe5ba92f2804cf091bde33c8290d4 (patch) | |
| tree | 4aa8a480a4be21d1c1f78ca6ec19feed4ef5c313 /stack/mcap | |
| parent | 27eaaa6e0a490c357411196938a913c958020b39 (diff) | |
| download | android_system_bt-2bb37becb8efe5ba92f2804cf091bde33c8290d4.tar.gz android_system_bt-2bb37becb8efe5ba92f2804cf091bde33c8290d4.tar.bz2 android_system_bt-2bb37becb8efe5ba92f2804cf091bde33c8290d4.zip | |
Allocate buffers of the right size when BT_HDR is included
Bug: 63146105
Test: External script
Change-Id: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
Merged-In: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
(cherry picked from commit 8810ffba990f8f53172c445ebde8707525bb7813)
CVE-2017-0781
Diffstat (limited to 'stack/mcap')
| -rw-r--r-- | stack/mcap/mca_cact.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/stack/mcap/mca_cact.c b/stack/mcap/mca_cact.c index fd1779e06..8ac75bf21 100644 --- a/stack/mcap/mca_cact.c +++ b/stack/mcap/mca_cact.c @@ -124,7 +124,7 @@ void mca_ccb_snd_req(tMCA_CCB *p_ccb, tMCA_CCB_EVT *p_data) p_ccb->p_tx_req = p_msg; if (!p_ccb->cong) { - p_pkt = (BT_HDR *)GKI_getbuf (MCA_CTRL_MTU); + p_pkt = (BT_HDR *)GKI_getbuf (MCA_CTRL_MTU + sizeof(BT_HDR)); if (p_pkt) { p_pkt->offset = L2CAP_MIN_OFFSET; @@ -171,7 +171,7 @@ void mca_ccb_snd_rsp(tMCA_CCB *p_ccb, tMCA_CCB_EVT *p_data) MCA_TRACE_DEBUG ("mca_ccb_snd_rsp cong=%d req=%d", p_ccb->cong, p_msg->op_code); /* assume that API functions verified the parameters */ - p_pkt = (BT_HDR *)GKI_getbuf (MCA_CTRL_MTU); + p_pkt = (BT_HDR *)GKI_getbuf (MCA_CTRL_MTU + sizeof(BT_HDR)); if (p_pkt) { p_pkt->offset = L2CAP_MIN_OFFSET; @@ -412,7 +412,7 @@ void mca_ccb_hdl_req(tMCA_CCB *p_ccb, tMCA_CCB_EVT *p_data) if (((reject_code != MCA_RSP_SUCCESS) && (evt_data.hdr.op_code != MCA_OP_SYNC_INFO_IND)) || send_rsp) { - p_buf = (BT_HDR *)GKI_getbuf (MCA_CTRL_MTU); + p_buf = (BT_HDR *)GKI_getbuf (MCA_CTRL_MTU + sizeof(BT_HDR)); if (p_buf) { p_buf->offset = L2CAP_MIN_OFFSET; |