Hi Inga,
On Thu, Aug 05, 2010, Inga Stotland wrote:
> + while (len < EIR_DATA_LENGTH - 1) {
> + uint8_t type = eir_data[1];
> + uint8_t field_len = eir_data[0];
> +
> + /* Check for the end of EIR */
> + if (field_len == 0)
> + break;
Shouldn't there also be another check here:
/* Bail out if field_len claims to reach beyond the EIR
* data end */
if (len + field_len + 1 >= EIR_DATA_LENGTH)
break;
Johan
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
