commit bf6f32b19ed34d29eaf5f0332aa0f8b234fcb167
author Pavlin Radoslavov <pavlin@google.com> Mon Jul 17 18:12:10 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Jul 26 23:55:09 2017 +0000
tree a1b1dd0d1528fda1ac5d61246b9528695bc926a6
parent 85dab2d15af9052ee33901f60f2dc964d8729118

Add missing extension length check while parsing BNEP control packets

Bug: 63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit 9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit dc7700a43189d2a8607b69ae19a6d646f11ddf51)
(cherry picked from commit c7874f25a0557ca4413d8db80bab8da842fc389a)
(cherry picked from commit 187bd8aec0aae63c6328981041e5ec7764ece6a9)
(cherry picked from commit 01f46e0aff705dab350cda7f648fb94976ea3988)
(cherry picked from commit e07d37969e654fd6be308232b15c1ed716205543)

stack/bnep/bnep_utils.c

diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c
index a0c8846..e16ffca 100644
--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -886,7 +886,7 @@
         BNEP_TRACE_ERROR("%s: BNEP - bad ctl pkt type: %d", __func__,
                          control_type);
         bnep_send_command_not_understood (p_bcb, control_type);
-        if (is_ext)
+        if (is_ext && (ext_len > 0))
         {
             if (*rem_len < (ext_len - 1)) {
                 goto bad_packet_length;