]> git.karo-electronics.de Git - karo-tx-linux.git/commit
Bluetooth: Check for minimum data length in eir_has_data_type()
authorJohan Hedberg <johan.hedberg@intel.com>
Mon, 26 Mar 2012 11:21:42 +0000 (14:21 +0300)
committerGustavo Padovan <gustavo@padovan.org>
Wed, 28 Mar 2012 15:29:00 +0000 (12:29 -0300)
commitdb4b3eccbad6869584e567e2e17adf6397e47c59
treeb54ddb72187a420721655bc1cc78ebc0f1ab2231
parent2ac980970d78de43dcfa9a111d9b43d339db062d
Bluetooth: Check for minimum data length in eir_has_data_type()

If passed 0 as data_length the (parsed < data_length - 1) test will be
true and cause a buffer overflow. In practice we need at least two bytes
for the element length and type so add a test for it to the very
beginning of the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
include/net/bluetooth/hci_core.h