OSDN Git Service

Fix out of bounds read in l2c_rcv_acl_data
authorJakub Pawlowski <jpawlowski@google.com>
Fri, 22 Jun 2018 09:57:19 +0000 (02:57 -0700)
committerJakub Pawlowski <jpawlowski@google.com>
Fri, 13 Jul 2018 04:46:57 +0000 (04:46 +0000)
Test: none
Bug: 80432895
Change-Id: I7807d00c02a84c545476e84bc1b71e0718df1f24
Merged-In: I7807d00c02a84c545476e84bc1b71e0718df1f24

stack/l2cap/l2c_main.cc

index 8a3317b..77d58e5 100644 (file)
@@ -68,7 +68,7 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) {
   uint8_t pkt_type;
   tL2C_LCB* p_lcb;
   tL2C_CCB* p_ccb = NULL;
-  uint16_t l2cap_len, rcv_cid, psm;
+  uint16_t l2cap_len, rcv_cid;
   uint16_t credit;
 
   /* Extract the handle */
@@ -176,8 +176,6 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) {
     osi_free(p_msg);
   } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {
     /* process_connectionless_data (p_lcb); */
-    STREAM_TO_UINT16(psm, p);
-    L2CAP_TRACE_DEBUG("GOT CONNECTIONLESS DATA PSM:%d", psm);
 
 #if (L2CAP_UCD_INCLUDED == TRUE)
     /* if it is not broadcast, check UCD registration */