Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ
Bug: 74121659
Test: Compiles
Change-Id: Idf58e7b25b41ae1bd43cdd51de424b18e03cc7e8
(cherry picked from commit ca4f8a18bce9331360144f1dbc51db1e2525bcc3)
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index 6c7820f..17ce2d3 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -33,6 +33,7 @@
#include "hcimsgs.h"
#include "l2c_int.h"
#include "l2cdefs.h"
+#include "log/log.h"
#include "osi/include/osi.h"
#include "stack_config.h"
@@ -788,6 +789,10 @@
break;
case L2CAP_CMD_DISC_REQ:
+ if (p + 4 > p_pkt_end) {
+ android_errorWriteLog(0x534e4554, "74121659");
+ return;
+ }
STREAM_TO_UINT16(lcid, p);
STREAM_TO_UINT16(rcid, p);