diff options
| author | Johan Hedberg <[email protected]> | 2012-03-26 14:21:42 +0300 |
|---|---|---|
| committer | Gustavo Padovan <[email protected]> | 2012-03-28 12:02:40 -0300 |
| commit | 6c0c331e4c8ff6c0f7fa6cc5fd08d853d6c579c4 (patch) | |
| tree | 819f4bb17b492dae2d9e7929dfd8cb31f072073d /net/lapb/lapb_timer.c | |
| parent | 84d9d0716b2d5f4a27de4801bd2dbf7aff5e1c38 (diff) | |
Bluetooth: Check for minimum data length in eir_has_data_type()
If passed 0 as data_length the (parsed < data_length - 1) test will be
true and cause a buffer overflow. In practice we need at least two bytes
for the element length and type so add a test for it to the very
beginning of the function.
Signed-off-by: Johan Hedberg <[email protected]>
Acked-by: Marcel Holtmann <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions