[automerger] DO NOT MERGE: Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_...

Change-Id: I3e632c0dd3d5552a0e06f85adeeec91670aa00c4

diff --git a/stack/l2cap/l2c_ble.c b/stack/l2cap/l2c_ble.c
index 5a3a569..9104078 100644 (file)
--- a/stack/l2cap/l2c_ble.c
+++ b/stack/l2cap/l2c_ble.c
@@ -32,6 +32,7 @@
 #include "hcimsgs.h"
 #include "device/include/controller.h"
 #include "stack_config.h"
+#include "log/log.h"
 
 #if (BLE_INCLUDED == TRUE)
 
@@ -829,6 +830,10 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len)
             break;
 
         case L2CAP_CMD_DISC_REQ:
+            if (p + 4 >= p_pkt_end) {
+              android_errorWriteLog(0x534e4554, "63146237");
+              return;
+            }
             STREAM_TO_UINT16 (lcid, p);
             STREAM_TO_UINT16 (rcid, p);