From 17421e456a8da21c01650183db7305c3820e695b Mon Sep 17 00:00:00 2001 From: Andrei Emeltchenko Date: Fri, 19 Mar 2010 10:26:28 +0200 Subject: [PATCH] --- yaml --- r: 188885 b: refs/heads/master c: c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 h: refs/heads/master i: 188883: 64a0038c048acc8c9c4b82816654ce4baa5f4d80 v: v3 --- [refs] | 2 +- trunk/net/bluetooth/l2cap.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index 1ae9875d9a13..3a21803177ad 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: aef7d97cc604309b66f6f45cce02cd734934cd4e +refs/heads/master: c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c index 43e17f7d7ecd..7794a2e2adce 100644 --- a/trunk/net/bluetooth/l2cap.c +++ b/trunk/net/bluetooth/l2cap.c @@ -2832,6 +2832,11 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr int len = cmd->len - sizeof(*rsp); char req[64]; + if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { + l2cap_send_disconn_req(conn, sk); + goto done; + } + /* throw out any old stored conf requests */ result = L2CAP_CONF_SUCCESS; len = l2cap_parse_conf_rsp(sk, rsp->data,