commit abc3023b05872f49a1e0e5c078a33dc055b62afb
author Venkata Jagadeesh Garaga <vgaraga@codeaurora.org> Thu Apr 18 17:13:49 2019 +0530
committer Manjae Park <manjaepark@google.com> Mon Dec 16 12:40:06 2019 -0800
tree b0a19e39e92a4b5d82ff4aa99bc28959def200a6
parent 3cea33eda1344922d60c98d03adf2e91f9327d9a

GAP: Correct the continuous pkt length in l2cap

L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.

Wrong pkt length leading to memory corruption

Hence the Correct the continuous pkt length in
l2cap reassembly logic.

Bug: 135239489
Bug: 143894715
CRs-Fixed: 2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit 337bd4579453bd6bf98ff519de3ac1019cd30d28)
(cherry picked from commit 602f4b44fe30ec8b225e1cee5f96817607d93e5a)

hci/src/packet_fragmenter.cc

diff --git a/hci/src/packet_fragmenter.cc b/hci/src/packet_fragmenter.cc
index 921ac82..217b4fd 100644
--- a/hci/src/packet_fragmenter.cc
+++ b/hci/src/packet_fragmenter.cc
@@ -216,7 +216,8 @@
                  "%s got packet which would exceed expected length of %d. "
                  "Truncating.",
                  __func__, partial_packet->len);
-        packet->len = partial_packet->len - partial_packet->offset;
+        packet->len =
+            (partial_packet->len - partial_packet->offset) + packet->offset;
         projected_offset = partial_packet->len;
       }