diff options
author | Andrei Emeltchenko <andrei.emeltchenko@nokia.com> | 2010-09-15 07:28:43 -0400 |
---|---|---|
committer | Gustavo F. Padovan <padovan@profusion.mobi> | 2010-10-12 11:44:52 -0400 |
commit | aae7fe22a875a84e328469e228cba033ebbf20cb (patch) | |
tree | 7d626dac2d97753784bd85f23c2480682c7f6745 /net/bluetooth | |
parent | 8979481328dc2e14cea9f99b3562ffcf8655998e (diff) |
Bluetooth: check for l2cap header in start fragment
BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned
"Note: Start Fragments always begin with the Basic L2CAP header
of a PDU."
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Diffstat (limited to 'net/bluetooth')
-rw-r--r-- | net/bluetooth/l2cap.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c index 5441083ff1c..7da6432f679 100644 --- a/net/bluetooth/l2cap.c +++ b/net/bluetooth/l2cap.c | |||
@@ -4675,7 +4675,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl | |||
4675 | l2cap_conn_unreliable(conn, ECOMM); | 4675 | l2cap_conn_unreliable(conn, ECOMM); |
4676 | } | 4676 | } |
4677 | 4677 | ||
4678 | if (skb->len < 2) { | 4678 | /* Start fragment always begin with Basic L2CAP header */ |
4679 | if (skb->len < L2CAP_HDR_SIZE) { | ||
4679 | BT_ERR("Frame is too short (len %d)", skb->len); | 4680 | BT_ERR("Frame is too short (len %d)", skb->len); |
4680 | l2cap_conn_unreliable(conn, ECOMM); | 4681 | l2cap_conn_unreliable(conn, ECOMM); |
4681 | goto drop; | 4682 | goto drop; |