commit 84c28b6c7978f0f9a449cbac416324c41f1bad32
author Pavlin Radoslavov <pavlin@google.com> Mon Jul 17 16:03:21 2017 -0700
committer JP Sugarbroad <jpsugar@google.com> Tue Aug 29 16:44:16 2017 -0700
tree adebe1fa6e5338f629c7affd64ac10fd63c38ab6
parent a26e709d1922fce4f87db048c5498eb99e9b93e8

Add missing extension length check while parsing BNEP control packets

Bug: 63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit 9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit dc7700a43189d2a8607b69ae19a6d646f11ddf51)

stack/bnep/bnep_utils.cc

diff --git a/stack/bnep/bnep_utils.cc b/stack/bnep/bnep_utils.cc
index f2be411..872f4f5 100644
--- a/stack/bnep/bnep_utils.cc
+++ b/stack/bnep/bnep_utils.cc
@@ -832,7 +832,7 @@
       BNEP_TRACE_ERROR("%s: BNEP - bad ctl pkt type: %d", __func__,
                        control_type);
       bnep_send_command_not_understood(p_bcb, control_type);
-      if (is_ext) {
+      if (is_ext && (ext_len > 0)) {
         if (*rem_len < (ext_len - 1)) {
           goto bad_packet_length;
         }