commit abbcc5c7f2837ba585aa60516658be30e9cafa80
author Pavlin Radoslavov <pavlin@google.com> Mon Jul 17 18:12:10 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Sep 13 22:06:34 2017 +0000
tree 7b64392a11c03963c357d4ffa049ddc4b59c1312
parent 1883243557c54ba042b355e123017a1827a70d92

Add missing extension length check while parsing BNEP control packets

Bug: 63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit 9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit dc7700a43189d2a8607b69ae19a6d646f11ddf51)
(cherry picked from commit c7874f25a0557ca4413d8db80bab8da842fc389a)
(cherry picked from commit 187bd8aec0aae63c6328981041e5ec7764ece6a9)
(cherry picked from commit 01f46e0aff705dab350cda7f648fb94976ea3988)

stack/bnep/bnep_utils.c

diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c
index 611cb12..a0af687 100644
--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -909,7 +909,7 @@
         BNEP_TRACE_ERROR("%s: BNEP - bad ctl pkt type: %d", __func__,
                          control_type);
         bnep_send_command_not_understood (p_bcb, control_type);
-        if (is_ext)
+        if (is_ext && (ext_len > 0))
         {
             if (*rem_len < (ext_len - 1)) {
                 goto bad_packet_length;