michaelh/zephyr
1
0
Fork 0
Code Releases Activity

bluetooth: AVDTP: Check buffer len before pulling data

Browse source 
Check the remaining buffer length is not less than
required data length before pulling data from the
buffer.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
This commit is contained in:
Lyle Zhu 2024-09-04 09:38:48 +08:00 • committed by Anas Nashif
commit 8113ff7e9c
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
subsys/bluetooth/host/classic/avdtp.c
View file

@ -919,6 +919,11 @@ int bt_avdtp_l2cap_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
struct net_buf *rsp_buf; struct net_buf *rsp_buf;
int err; int err;
if (buf->len < sizeof(sigid)) {
LOG_ERR("Invalid AVDTP Header");
return 0;
}
sigid = net_buf_pull_u8(buf); sigid = net_buf_pull_u8(buf);
rsp_buf = avdtp_create_reply_pdu(BT_AVDTP_REJECT, rsp_buf = avdtp_create_reply_pdu(BT_AVDTP_REJECT,
BT_AVDTP_PACKET_TYPE_SINGLE, BT_AVDTP_PACKET_TYPE_SINGLE,