commit d5b44f6522c3294d6f5fd71bc6670f625f716460
author Hansong Zhang <hsz@google.com> Thu Jul 12 10:44:29 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jul 27 18:46:14 2018 +0000
tree fa2255512588b51746703d6e058fbdf66b7b3424
parent bdbabb2ca4ebb4dc5971d3d42cb12f8048e23a23

Fix OOB read in process_l2cap_cmd

Test: manual
Bug: 79488381
Change-Id: I723866ed40d3647fed99875f659bb95df96a6969
(cherry picked from commit 5bb66307b555b17d1764e116316ce50c687c9653)

stack/l2cap/l2c_main.cc

diff --git a/stack/l2cap/l2c_main.cc b/stack/l2cap/l2c_main.cc
index 2574f88..a69c029 100644
--- a/stack/l2cap/l2c_main.cc
+++ b/stack/l2cap/l2c_main.cc
@@ -511,6 +511,7 @@
             default:
               /* sanity check option length */
               if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len) {
+                if (p + cfg_len > p_next_cmd) return;
                 p += cfg_len;
                 if ((cfg_code & 0x80) == 0) {
                   cfg_rej_len += cfg_len + L2CAP_CFG_OPTION_OVERHEAD;