Skip to content

Commit 2a1bcc2

Browse files
lylezhu2012kartben
authored andcommitted
Bluetooth: Classic: L2CAP: Fix issue is received data len less than 2
If the received data length is less than 2 in none basic mode, the L2CAP channel connection will be dropped. Only check the received data length if the `SAR` is `BT_L2CAP_CONTROL_SAR_START`. Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
1 parent 63dbc4c commit 2a1bcc2

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

subsys/bluetooth/host/classic/l2cap_br.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5767,17 +5767,15 @@ static void bt_l2cap_br_ret_fc_i_recv(struct bt_l2cap_br_chan *br_chan, struct n
57675767

57685768
valid_frame:
57695769
switch (sar) {
5770-
case BT_L2CAP_CONTROL_SAR_UNSEG:
5771-
__fallthrough;
57725770
case BT_L2CAP_CONTROL_SAR_START:
57735771
if (buf->len < 2) {
5774-
LOG_WRN("Invalid SDU length");
5772+
LOG_WRN("Too short data packet");
57755773
bt_l2cap_chan_disconnect(&br_chan->chan);
57765774
return;
57775775
}
57785776
break;
5777+
case BT_L2CAP_CONTROL_SAR_UNSEG:
57795778
case BT_L2CAP_CONTROL_SAR_END:
5780-
__fallthrough;
57815779
case BT_L2CAP_CONTROL_SAR_CONTI:
57825780
break;
57835781
}

0 commit comments

Comments
 (0)