OSDN Git Service
(root)
/
android-x86
/
system-bt.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
30994ca
)
HID Host: Check L2CAP packet data length
author
Hansong Zhang
<hsz@google.com>
Thu, 7 Jun 2018 21:25:09 +0000
(14:25 -0700)
committer
android-build-team Robot
<android-build-team-robot@google.com>
Fri, 3 Aug 2018 19:18:14 +0000
(19:18 +0000)
Bug:
80493272
Test: manual
Change-Id: I8b1acd11616684729752195fabb4fa34c46a508d
(cherry picked from commit
ca47a05acb66218ff2123f8d4642961f7f2eb5e2
)
stack/hid/hidh_conn.cc
patch
|
blob
|
history
diff --git
a/stack/hid/hidh_conn.cc
b/stack/hid/hidh_conn.cc
index
1ab03b7
..
a41aa90
100644
(file)
--- a/
stack/hid/hidh_conn.cc
+++ b/
stack/hid/hidh_conn.cc
@@
-42,6
+42,7
@@
#include "hidh_api.h"
#include "hidh_int.h"
+#include "log/log.h"
#include "osi/include/osi.h"
static uint8_t find_conn_by_cid(uint16_t cid);
@@
-799,6
+800,14
@@
static void hidh_l2cif_data_ind(uint16_t l2cap_cid, BT_HDR* p_msg) {
return;
}
+ if (p_msg->len < 1) {
+ HIDH_TRACE_WARNING("Rcvd L2CAP data, invalid length %d, should be >= 1",
+ p_msg->len);
+ osi_free(p_msg);
+ android_errorWriteLog(0x534e4554, "80493272");
+ return;
+ }
+
ttype = HID_GET_TRANS_FROM_HDR(*p_data);
param = HID_GET_PARAM_FROM_HDR(*p_data);
rep_type = param & HID_PAR_REP_TYPE_MASK;