commit d75369349692542ff3159b77fd5183ecd9aa5629
author Hansong Zhang <hsz@google.com> Fri Jul 13 13:45:46 2018 -0700
committer JP Sugarbroad <jpsugar@google.com> Thu Aug 16 17:17:18 2018 -0700
tree 5d769bf29230d8de990a458ddb9f5a3a080b05b6
parent d332d3afc6ef88de28f330f9512b0c118af05959

Fix a wrong check in rfc_parse_data

Bug: 78288018
Bug: 111436796
Test: manual
Change-Id: I16e6026acbaac230fe1453bbac040d1b75bcea2a
(cherry picked from commit d1ced302cd1066087588c891027b1756be31db46)

stack/rfcomm/rfc_ts_frames.cc

diff --git a/stack/rfcomm/rfc_ts_frames.cc b/stack/rfcomm/rfc_ts_frames.cc
index b959827..93a8592 100644
--- a/stack/rfcomm/rfc_ts_frames.cc
+++ b/stack/rfcomm/rfc_ts_frames.cc
@@ -520,7 +520,7 @@
 
   eal = *(p_data)&RFCOMM_EA;
   len = *(p_data)++ >> RFCOMM_SHIFT_LENGTH1;
-  if (eal == 0 && p_buf->len < RFCOMM_CTRL_FRAME_LEN) {
+  if (eal == 0 && p_buf->len > RFCOMM_CTRL_FRAME_LEN) {
     len += (*(p_data)++ << RFCOMM_SHIFT_LENGTH2);
   } else if (eal == 0) {
     RFCOMM_TRACE_ERROR("Bad Length when EAL = 0: %d", p_buf->len);