OSDN Git Service

Fix potential OOB write in btm_read_remote_ext_features_complete
authorTed Wang <tedwang@google.com>
Tue, 26 Nov 2019 03:46:38 +0000 (11:46 +0800)
committerJakub Pawlowski <jpawlowski@google.com>
Tue, 26 Nov 2019 21:37:36 +0000 (22:37 +0100)
commit2aa92f871c2f2ea2181b74b49bf152f2606fb7c5
tree454474fe888f2b1eeadf60541b77e5ca628f2922
parentf63a4169bab6eeaa84ed86b54bd9f7ab91be0976
Fix potential OOB write in btm_read_remote_ext_features_complete

Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.

Bug: 141552859
Bug: 144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
stack/btm/btm_acl.cc
stack/btm/btm_int.h
stack/btu/btu_hcif.cc
stack/include/hcidefs.h