bluetooth: AVDTP: Check buffer len before pulling data
Check the remaining buffer length is not less than required data length before pulling data from the buffer. Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
This commit is contained in:
parent
b97300e414
commit
8113ff7e9c
1 changed files with 5 additions and 0 deletions
|
@ -919,6 +919,11 @@ int bt_avdtp_l2cap_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
|
|||
struct net_buf *rsp_buf;
|
||||
int err;
|
||||
|
||||
if (buf->len < sizeof(sigid)) {
|
||||
LOG_ERR("Invalid AVDTP Header");
|
||||
return 0;
|
||||
}
|
||||
|
||||
sigid = net_buf_pull_u8(buf);
|
||||
rsp_buf = avdtp_create_reply_pdu(BT_AVDTP_REJECT,
|
||||
BT_AVDTP_PACKET_TYPE_SINGLE,
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue