commit 521621d51591d3406038a6eb80e21902801cc5ce
author Myles Watson <mylesgw@google.com> Fri Aug 11 16:47:28 2017 -0700
committer Myles Watson <mylesgw@google.com> Thu Aug 24 16:24:18 2017 +0000
tree a61197a12690409d6bf0b56ce9d92abb5beb3515
parent 36cb0a2d998ecccd32f76a6d788da5282bfd8bd9

Bluetooth: Check H4 HCI packet types

An invalid type byte can cause an access outside
the bounds of the array.

Bug: 64565737
Test: Bluetooth On/Off
Change-Id: Ie11dd62942f66b9fc60ebce2e4339c37d597fdf0

bluetooth/1.0/default/h4_protocol.cc

diff --git a/bluetooth/1.0/default/h4_protocol.cc b/bluetooth/1.0/default/h4_protocol.cc
index 2008b00..5a89557 100644
--- a/bluetooth/1.0/default/h4_protocol.cc
+++ b/bluetooth/1.0/default/h4_protocol.cc
@@ -81,6 +81,12 @@
       }
     }
     hci_packet_type_ = static_cast<HciPacketType>(buffer[0]);
+    if (hci_packet_type_ != HCI_PACKET_TYPE_ACL_DATA &&
+        hci_packet_type_ != HCI_PACKET_TYPE_SCO_DATA &&
+        hci_packet_type_ != HCI_PACKET_TYPE_EVENT) {
+      LOG_ALWAYS_FATAL("%s: Unimplemented packet type %d", __func__,
+                       static_cast<int>(hci_packet_type_));
+    }
   } else {
     hci_packetizer_.OnDataReady(fd, hci_packet_type_);
   }