DO NOT MERGE Add bounds check for BNEP_Write

Bug: 74947856
Test: manual
Change-Id: If5db8c6b6e509a330ae74808fc3f0ffac137af14
(cherry picked from commit ae9d06c1dc84db36c0c4a07fc56a1fbf008cd1ce)

diff --git a/stack/bnep/bnep_api.cc b/stack/bnep/bnep_api.cc
index 923ce50..e5d3c09 100644 (file)
--- a/stack/bnep/bnep_api.cc
+++ b/stack/bnep/bnep_api.cc
@@ -23,6 +23,7 @@
  ******************************************************************************/
 
 #include "bnep_api.h"
+#include <log/log.h>
 #include <string.h>
 #include "bnep_int.h"
 
@@ -383,6 +384,10 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr,
         protocol = 0;
       else {
         new_len += 4;
+        if (new_len > org_len) {
+          android_errorWriteLog(0x534e4554, "74947856");
+          return BNEP_IGNORE_CMD;
+        }
         p_data[2] = 0;
         p_data[3] = 0;
       }
@@ -479,6 +484,10 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr,
         protocol = 0;
       else {
         new_len += 4;
+        if (new_len > org_len) {
+          android_errorWriteLog(0x534e4554, "74947856");
+          return BNEP_IGNORE_CMD;
+        }
         p_data[2] = 0;
         p_data[3] = 0;
       }