commit 72da9957df258fb80a7c01085720dba5364967d4
author Ajay Panicker <apanicke@google.com> Thu Apr 12 17:03:09 2018 -0700
committer JP Sugarbroad <jpsugar@google.com> Wed May 30 16:02:01 2018 -0700
tree 3505f81ec1406f58b58e4a8e6b1bab408db6a63b
parent 04cc9da1f5c6f610c9ac9af69349469f7b32fa7e

Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ

Bug: 74121659
Test: Compiles
Change-Id: Idf58e7b25b41ae1bd43cdd51de424b18e03cc7e8
(cherry picked from commit ca4f8a18bce9331360144f1dbc51db1e2525bcc3)

stack/l2cap/l2c_ble.cc

diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index d15a87a..0366a0c 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -31,6 +31,7 @@
 #include "hcimsgs.h"
 #include "l2c_int.h"
 #include "l2cdefs.h"
+#include "log/log.h"
 #include "osi/include/osi.h"
 #include "stack_config.h"
 
@@ -796,6 +797,10 @@
       break;
 
     case L2CAP_CMD_DISC_REQ:
+      if (p + 4 > p_pkt_end) {
+        android_errorWriteLog(0x534e4554, "74121659");
+        return;
+      }
       STREAM_TO_UINT16(lcid, p);
       STREAM_TO_UINT16(rcid, p);