From be3841b10d3abcd0c6e3b54b57ace15c2efbc1c1 Mon Sep 17 00:00:00 2001 From: Marcin Kraglak Date: Tue, 11 Feb 2014 11:51:00 +0100 Subject: [PATCH] emulator/bthost: Check length of received RFCOMM DM frames Ignore too short received RFCOMM DM frames. --- emulator/bthost.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/emulator/bthost.c b/emulator/bthost.c index 2cd79bcaa..33a05449f 100644 --- a/emulator/bthost.c +++ b/emulator/bthost.c @@ -1669,9 +1669,14 @@ static void rfcomm_dm_recv(struct bthost *bthost, struct btconn *conn, uint16_t len) { const struct rfcomm_cmd *hdr = data; - uint8_t channel = RFCOMM_GET_CHANNEL(hdr->address); + uint8_t channel; struct rfcomm_connection_data *conn_data = bthost->rfcomm_conn_data; + if (len < sizeof(*hdr)) + return; + + channel = RFCOMM_GET_CHANNEL(hdr->address); + if (conn_data && conn_data->channel == channel) { if (conn_data->cb) conn_data->cb(conn->handle, l2conn->scid, -- 2.47.3