OSDN Git Service

BNEP: Fix OOB access in bnep_data_ind
authorJack He <siyuanh@google.com>
Fri, 1 Jun 2018 21:00:42 +0000 (14:00 -0700)
committerJack He <siyuanh@google.com>
Fri, 1 Jun 2018 23:45:37 +0000 (23:45 +0000)
commit0416340ffa61337dbaa2f6602ef85a1c32563ec2
tree87a7b035b4a84d70395b65abbef6132ae85a9b66
parent05e2099ec7d28c8688c1f242e9ef749e203916a3
BNEP: Fix OOB access in bnep_data_ind

* Stop reading the L2CAP packet if packet length is 0
* Process the buffer for BNEP_EXTENSION_CONTROL packet before advancing
  the buffer pointer by length of payload
* Reject BNEP_EXTENSION_CONTROL packet when the payload size is zero
* Move error logging to more appropriate locations at where the OOB access
  is most likely triggered

Bug: 78286118
Bug: 79164722
Test: Send zero length L2CAP packet to BNEP, send invalid
      BNEP_EXTENSION_CONTROL packet
Merged-In: I7e18632b8faab1b6aaca1bff1b7f55d69962729e
Change-Id: I7e18632b8faab1b6aaca1bff1b7f55d69962729e
(cherry picked from commit 3c799a6e25abdf6bacb660ff7a06338836cc7356)
stack/bnep/bnep_main.cc