]> git.itanic.dy.fi Git - linux-stable/commit
Bluetooth: Fix missing length checks for L2CAP signalling PDUs
authorJohan Hedberg <johan.hedberg@intel.com>
Tue, 28 May 2013 10:46:30 +0000 (13:46 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 20 Jun 2013 19:01:28 +0000 (12:01 -0700)
commit22b74ee1ace2536bb4889c33f1de932d2814376a
tree09822c90f801843f57b006c4dcbf0e9c7cdfc7fb
parenta534b5b5b7c501151f8a337a59525d7493733a35
Bluetooth: Fix missing length checks for L2CAP signalling PDUs

commit cb3b3152b2f5939d67005cff841a1ca748b19888 upstream.

There has been code in place to check that the L2CAP length header
matches the amount of data received, but many PDU handlers have not been
checking that the data received actually matches that expected by the
specific PDU. This patch adds passing the length header to the specific
handler functions and ensures that those functions fail cleanly in the
case of an incorrect amount of data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/bluetooth/l2cap_core.c