X-Git-Url: http://git.osdn.net/view?a=blobdiff_plain;f=stack%2Fl2cap%2Fl2c_main.c;h=3c48d6974376ba6808db7344d85a39e6d603f9e9;hb=09e0687799052f92f3a9404dc7fe08a5c7b0b051;hp=ad1e583d70fefb07b1cce7648aedd3b58ceaa9f0;hpb=6e7a5f00d045155709525032851d6aef42f822c0;p=android-x86%2Fsystem-bt.git diff --git a/stack/l2cap/l2c_main.c b/stack/l2cap/l2c_main.c index ad1e583d7..3c48d6974 100644 --- a/stack/l2cap/l2c_main.c +++ b/stack/l2cap/l2c_main.c @@ -28,6 +28,8 @@ #include #include +#include + #include "bt_target.h" #include "btm_int.h" #include "btu.h" @@ -132,6 +134,14 @@ void l2c_rcv_acl_data (BT_HDR *p_msg) STREAM_TO_UINT16 (hci_len, p); p_msg->offset += 4; + if (hci_len < L2CAP_PKT_OVERHEAD) { + /* Must receive at least the L2CAP length and CID */ + L2CAP_TRACE_WARNING ("L2CAP - got incorrect hci header"); + android_errorWriteLog(0x534e4554, "34946955"); + osi_free(p_msg); + return; + } + /* Extract the length and CID */ STREAM_TO_UINT16 (l2cap_len, p); STREAM_TO_UINT16 (rcv_cid, p); @@ -154,17 +164,8 @@ void l2c_rcv_acl_data (BT_HDR *p_msg) } } - if (hci_len >= L2CAP_PKT_OVERHEAD) /* Must receive at least the L2CAP length and CID.*/ - { - p_msg->len = hci_len - L2CAP_PKT_OVERHEAD; - p_msg->offset += L2CAP_PKT_OVERHEAD; - } - else - { - L2CAP_TRACE_WARNING ("L2CAP - got incorrect hci header" ); - osi_free(p_msg); - return; - } + p_msg->len = hci_len - L2CAP_PKT_OVERHEAD; + p_msg->offset += L2CAP_PKT_OVERHEAD; if (l2cap_len != p_msg->len) { @@ -858,6 +859,7 @@ void l2c_init (void) void l2c_free(void) { list_free(l2cb.rcv_pending_q); + l2cb.rcv_pending_q = NULL; } void l2c_receive_hold_timer_timeout(UNUSED_ATTR void *data)