commit ba0c7970ff2444dadb8c21b527cda31d6824803e
author Hansong Zhang <hsz@google.com> Wed Apr 11 16:04:51 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Aug 03 19:13:40 2018 +0000
tree 01439e531bf91ad9f04c828afabb32fc7a102ae1
parent c0d58827cd96e4aa4fc39b3a9de8fde4ad982190

DO NOT MERGE Add bounds check for BNEP_Write

Bug: 74947856
Test: manual
Change-Id: If5db8c6b6e509a330ae74808fc3f0ffac137af14
(cherry picked from commit ae9d06c1dc84db36c0c4a07fc56a1fbf008cd1ce)

stack/bnep/bnep_api.cc

diff --git a/stack/bnep/bnep_api.cc b/stack/bnep/bnep_api.cc
index 923ce50..e5d3c09 100644
--- a/stack/bnep/bnep_api.cc
+++ b/stack/bnep/bnep_api.cc
@@ -23,6 +23,7 @@
  ******************************************************************************/
 
 #include "bnep_api.h"
+#include <log/log.h>
 #include <string.h>
 #include "bnep_int.h"
 
@@ -383,6 +384,10 @@
         protocol = 0;
       else {
         new_len += 4;
+        if (new_len > org_len) {
+          android_errorWriteLog(0x534e4554, "74947856");
+          return BNEP_IGNORE_CMD;
+        }
         p_data[2] = 0;
         p_data[3] = 0;
       }
@@ -479,6 +484,10 @@
         protocol = 0;
       else {
         new_len += 4;
+        if (new_len > org_len) {
+          android_errorWriteLog(0x534e4554, "74947856");
+          return BNEP_IGNORE_CMD;
+        }
         p_data[2] = 0;
         p_data[3] = 0;
       }