| commit | 6c0c331e4c8ff6c0f7fa6cc5fd08d853d6c579c4 | [log] [tgz] |
|---|---|---|
| author | Johan Hedberg <johan.hedberg@intel.com> | Mon Mar 26 14:21:42 2012 +0300 |
| committer | Gustavo Padovan <gustavo@padovan.org> | Wed Mar 28 12:02:40 2012 -0300 |
| tree | 819f4bb17b492dae2d9e7929dfd8cb31f072073d | |
| parent | 84d9d0716b2d5f4a27de4801bd2dbf7aff5e1c38 [diff] |
Bluetooth: Check for minimum data length in eir_has_data_type() If passed 0 as data_length the (parsed < data_length - 1) test will be true and cause a buffer overflow. In practice we need at least two bytes for the element length and type so add a test for it to the very beginning of the function. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo@padovan.org>