Commit ab2476d8 authored Mar 12, 2021 by Luiz Augusto von Dentz Committed by Anas Nashif Mar 18, 2021

Bluetooth: L2CAP: Fix not checking for L2CAP_ECRED_CHAN_MAX

When receiving L2CAP_CREDIT_BASED_CONNECTION_REQ the remote may request
more channels than allowed so this checks if amount of channel surpasses
the maximum channels (5) and return an error.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

parent 1626b87d

subsys/bluetooth/host/l2cap.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -1107,6 +1107,13 @@ static void le_ecred_conn_req(struct bt_l2cap *l2cap, uint8_t ident,
		}

		req = net_buf_pull_mem(buf, sizeof(*req));

		if (buf->len > sizeof(dcid)) {
		BT_ERR("Too large LE conn req packet size");
		result = BT_L2CAP_LE_ERR_INVALID_PARAMS;
		goto response;
		}

		psm = sys_le16_to_cpu(req->psm);
		mtu = sys_le16_to_cpu(req->mtu);
		mps = sys_le16_to_cpu(req->mps);

Admin message