Fix OOB of L2CAP_CMD_CREDIT_BASED_CONN_RES

TAG: #security Bug: 213519176 Test: atest manual Ignore-AOSP-First: security fix (cherry picked from commit c9bf9d2d797bd56ecef848e95e183f84037d6c90) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:386ba28fa3a573fc09b1618cb4263cc919f3c4a2) Merged-In: Ieb6ebc88a40d044a0bbb3311fe2f5b7d5b571b9e Change-Id: Ieb6ebc88a40d044a0bbb3311fe2f5b7d5b571b9e
AICP · Nov 18, 2024 · 95a3ab9 · 95a3ab9
1 parent d6a3f95
commit 95a3ab9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/system/stack/l2cap/l2c_ble.cc b/system/stack/l2cap/l2c_ble.cc
@@ -670,7 +670,7 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
       break;
     }
     case L2CAP_CMD_CREDIT_BASED_CONN_RES:
-      if (p + 2 > p_pkt_end) {
+      if (p + 8 > p_pkt_end) {
         LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len";
         return;
       }