Merge "L2CAP: Check length for packet before connection complete" into qt-qpr1-dev
diff --git a/stack/l2cap/l2c_main.cc b/stack/l2cap/l2c_main.cc
index 128f60e..52d77c5 100644
--- a/stack/l2cap/l2c_main.cc
+++ b/stack/l2cap/l2c_main.cc
@@ -97,6 +97,11 @@
/* There is a slight possibility (specifically with USB) that we get an */
/* L2CAP connection request before we get the HCI connection complete. */
/* So for these types of messages, hold them for up to 2 seconds. */
+ if (l2cap_len == 0) {
+ L2CAP_TRACE_WARNING("received empty L2CAP packet");
+ osi_free(p_msg);
+ return;
+ }
uint8_t cmd_code;
STREAM_TO_UINT8(cmd_code, p);
