Bluetooth: check for l2cap header in start fragment
BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned "Note: Start Fragments always begin with the Basic L2CAP header of a PDU." Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
This commit is contained in:
parent
8979481328
commit
aae7fe22a8
|
@ -4675,7 +4675,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
|
|||
l2cap_conn_unreliable(conn, ECOMM);
|
||||
}
|
||||
|
||||
if (skb->len < 2) {
|
||||
/* Start fragment always begin with Basic L2CAP header */
|
||||
if (skb->len < L2CAP_HDR_SIZE) {
|
||||
BT_ERR("Frame is too short (len %d)", skb->len);
|
||||
l2cap_conn_unreliable(conn, ECOMM);
|
||||
goto drop;
|
||||
|
|
Loading…
Reference in a new issue