DO NOT MERGE Add bounds check for BNEP_Write

Bug: 74947856
Test: manual
Change-Id: I19d9dee53b9cac800c66becef4861e4ad9602bdf

diff --git a/stack/bnep/bnep_api.c b/stack/bnep/bnep_api.c
index 76bffca..d6c5633 100644 (file)
--- a/stack/bnep/bnep_api.c
+++ b/stack/bnep/bnep_api.c
@@ -25,6 +25,7 @@
 #include <string.h>
 #include "bnep_api.h"
 #include "bnep_int.h"
+#include "log/log.h"
 
 /*******************************************************************************
 **
@@ -413,6 +414,10 @@ tBNEP_RESULT BNEP_WriteBuf (UINT16 handle,
             else
             {
                 new_len += 4;
+                if (new_len > org_len) {
+                    android_errorWriteLog(0x534e4554, "74947856");
+                    return BNEP_IGNORE_CMD;
+                }
                 p_data[2] = 0;
                 p_data[3] = 0;
             }
@@ -521,6 +526,10 @@ tBNEP_RESULT  BNEP_Write (UINT16 handle,
             else
             {
                 new_len += 4;
+                if (new_len > org_len) {
+                    android_errorWriteLog(0x534e4554, "74947856");
+                    return BNEP_IGNORE_CMD;
+                }
                 p_data[2] = 0;
                 p_data[3] = 0;
             }