X-Git-Url: http://git.osdn.net/view?a=blobdiff_plain;f=stack%2Fhid%2Fhidh_conn.c;h=39ba8bc56c804805c95bfb7c0ee75deddb73e86e;hb=8a1add8a49ab0287333062d7aebf6ee8f4dd6ae3;hp=ffbafe4282f0b3b13c1f8fe305dc043bed2ce5a7;hpb=cc5bab19bdd7c16b2c75418b5dc87adca4a0ef3a;p=android-x86%2Fsystem-bt.git

diff --git a/stack/hid/hidh_conn.c b/stack/hid/hidh_conn.c
index ffbafe428..39ba8bc56 100644
--- a/stack/hid/hidh_conn.c
+++ b/stack/hid/hidh_conn.c
@@ -29,6 +29,7 @@
 
 #include "bt_common.h"
 #include "bt_types.h"
+#include "log/log.h"
 
 #include "l2cdefs.h"
 #include "l2c_api.h"
@@ -820,6 +821,13 @@ static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
         return;
     }
 
+    if (p_msg->len < 1)
+    {
+        HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP data, invalid length");
+        osi_free(p_msg);
+        android_errorWriteLog(0x534e4554, "80493272");
+        return;
+    }
 
     ttype    = HID_GET_TRANS_FROM_HDR(*p_data);
     param    = HID_GET_PARAM_FROM_HDR(*p_data);