1834dc7936
and that any data supposedly copied out is valid before use. prompted by maxv@, I have checked every usage of m_copydata() and made the following corrections hci_event.c: hci_event_command_compl() check that the packet does contain enough data for there to be a status code before noting possible failures. hci_event_num_compl_pkts() check that the packet does contain data to cover the stated number of handle/num pairs l2cap_signal.c: l2cap_recv_signal() just ignore packets with not enough data rather than trying to reject them (may not have cmd.ident) l2cap_recv_command_rej() check we have a valid reason and/or data before use |
||
|---|---|---|
| .. | ||
| Makefile | ||
| bluetooth.h | ||
| bt_proto.c | ||
| bt_sysctl.c | ||
| files.netbt | ||
| hci.h | ||
| hci_event.c | ||
| hci_ioctl.c | ||
| hci_link.c | ||
| hci_misc.c | ||
| hci_socket.c | ||
| hci_unit.c | ||
| l2cap.h | ||
| l2cap_lower.c | ||
| l2cap_misc.c | ||
| l2cap_signal.c | ||
| l2cap_socket.c | ||
| l2cap_upper.c | ||
| rfcomm.h | ||
| rfcomm_dlc.c | ||
| rfcomm_session.c | ||
| rfcomm_socket.c | ||
| rfcomm_upper.c | ||
| sco.h | ||
| sco_socket.c | ||
| sco_upper.c | ||