Bluetooth: check for l2cap header in start fragment
authorAndrei Emeltchenko <andrei.emeltchenko@nokia.com>
Wed, 15 Sep 2010 11:28:43 +0000 (14:28 +0300)
committerGustavo F. Padovan <padovan@profusion.mobi>
Tue, 12 Oct 2010 15:44:52 +0000 (12:44 -0300)
BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned
"Note: Start Fragments always begin with the Basic L2CAP header
of a PDU."

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
net/bluetooth/l2cap.c

index 5441083ff1caa4ced9975b3a2dda9544ff02ee38..7da6432f6799e713ba73ead30ba2e3a85bfda7ed 100644 (file)
@@ -4675,7 +4675,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                        l2cap_conn_unreliable(conn, ECOMM);
                }
 
-               if (skb->len < 2) {
+               /* Start fragment always begin with Basic L2CAP header */
+               if (skb->len < L2CAP_HDR_SIZE) {
                        BT_ERR("Frame is too short (len %d)", skb->len);
                        l2cap_conn_unreliable(conn, ECOMM);
                        goto drop;