| commit | 2dceafe75bda383e609910b3c882a155a32584af | [log] [tgz] |
|---|---|---|
| author | Chienyuan Huang <chienyuanhuang@google.com> | Wed Feb 09 06:38:48 2022 +0000 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Tue Mar 15 18:16:46 2022 +0000 |
| tree | 4153d4991014b0944997029d7d144019ae63c147 | |
| parent | 9827945fd41eb3c7940b5ce983e21757fdbae5f6 [diff] |
Fix OOB of L2CAP_CMD_CREDIT_BASED_CONN_RES Change-Id: Ic947572e179ec4dacae9655192cadac7cf8c3ea4 TAG: #security Bug: 213519176 Test: manual Ignore-AOSP-First: security fix (cherry picked from commit ed4b512d2b3d45151b7f70e4c8c60b1a052a5d7c) Merged-In: Ic947572e179ec4dacae9655192cadac7cf8c3ea4
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc index 16454a5..d548679 100644 --- a/stack/l2cap/l2c_ble.cc +++ b/stack/l2cap/l2c_ble.cc
@@ -621,7 +621,7 @@ break; } case L2CAP_CMD_CREDIT_BASED_CONN_RES: - if (p + 2 > p_pkt_end) { + if (p + 8 > p_pkt_end) { LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len"; return; }