tree 819f4bb17b492dae2d9e7929dfd8cb31f072073d
parent 84d9d0716b2d5f4a27de4801bd2dbf7aff5e1c38
author Johan Hedberg <johan.hedberg@intel.com> 1332760902 +0300
committer Gustavo Padovan <gustavo@padovan.org> 1332946960 -0300

Bluetooth: Check for minimum data length in eir_has_data_type()

If passed 0 as data_length the (parsed < data_length - 1) test will be
true and cause a buffer overflow. In practice we need at least two bytes
for the element length and type so add a test for it to the very
beginning of the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>