switch (cfg_code & 0x7F) {
case L2CAP_CFG_TYPE_MTU:
cfg_info.mtu_present = true;
- if (p + 2 > p_next_cmd) {
+ if (cfg_len != 2) {
+ android_errorWriteLog(0x534e4554, "119870451");
+ return;
+ }
+ if (p + cfg_len > p_next_cmd) {
android_errorWriteLog(0x534e4554, "74202041");
return;
}
case L2CAP_CFG_TYPE_FLUSH_TOUT:
cfg_info.flush_to_present = true;
- if (p + 2 > p_next_cmd) {
+ if (cfg_len != 2) {
+ android_errorWriteLog(0x534e4554, "119870451");
+ return;
+ }
+ if (p + cfg_len > p_next_cmd) {
android_errorWriteLog(0x534e4554, "74202041");
return;
}
case L2CAP_CFG_TYPE_QOS:
cfg_info.qos_present = true;
- if (p + 2 + 5 * 4 > p_next_cmd) {
+ if (cfg_len != 2 + 5 * 4) {
+ android_errorWriteLog(0x534e4554, "119870451");
+ return;
+ }
+ if (p + cfg_len > p_next_cmd) {
android_errorWriteLog(0x534e4554, "74202041");
return;
}
case L2CAP_CFG_TYPE_FCR:
cfg_info.fcr_present = true;
- if (p + 3 + 3 * 2 > p_next_cmd) {
+ if (cfg_len != 3 + 3 * 2) {
+ android_errorWriteLog(0x534e4554, "119870451");
+ return;
+ }
+ if (p + cfg_len > p_next_cmd) {
android_errorWriteLog(0x534e4554, "74202041");
return;
}
case L2CAP_CFG_TYPE_FCS:
cfg_info.fcs_present = true;
- if (p + 1 > p_next_cmd) {
+ if (cfg_len != 1) {
+ android_errorWriteLog(0x534e4554, "119870451");
+ return;
+ }
+ if (p + cfg_len > p_next_cmd) {
android_errorWriteLog(0x534e4554, "74202041");
return;
}
case L2CAP_CFG_TYPE_EXT_FLOW:
cfg_info.ext_flow_spec_present = true;
- if (p + 2 + 2 + 3 * 4 > p_next_cmd) {
+ if (cfg_len != 2 + 2 + 3 * 4) {
+ android_errorWriteLog(0x534e4554, "119870451");
+ return;
+ }
+ if (p + cfg_len > p_next_cmd) {
android_errorWriteLog(0x534e4554, "74202041");
return;
}