From fba18071c6d9fc3bfc1685f33a7ee687ec3b7eb0 Mon Sep 17 00:00:00 2001 From: Marcin Kraglak Date: Tue, 11 Feb 2014 11:50:59 +0100 Subject: [PATCH] emulator/bthost: Check length of received RFCOMM DISC frame Don't access rfcomm_hdr struct and ignore if frame is too short. --- emulator/bthost.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/emulator/bthost.c b/emulator/bthost.c index f92b47985..2cd79bcaa 100644 --- a/emulator/bthost.c +++ b/emulator/bthost.c @@ -1604,7 +1604,12 @@ static void rfcomm_disc_recv(struct bthost *bthost, struct btconn *conn, uint16_t len) { const struct rfcomm_cmd *hdr = data; - uint8_t dlci = RFCOMM_GET_DLCI(hdr->address); + uint8_t dlci; + + if (len < sizeof(*hdr)) + return; + + dlci = RFCOMM_GET_DLCI(hdr->address); rfcomm_ua_send(bthost, conn, l2conn, 0, dlci); } -- 2.47.3