Check remaining space in the packetbuf before writing to it in input_l2cap_frame_flow_channel().
@@ -452,6 +452,12 @@ input_l2cap_frame_flow_channel(l2cap_channel_t *channel, uint8_t *data, uint16_t
if((channel->rx_buffer.sdu_length > 0) &&
(channel->rx_buffer.sdu_length == channel->rx_buffer.current_index)) {
+ if(channel->rx_buffer.sdu_length > packetbuf_remaininglen()) {
+ LOG_WARN("l2cap_frame: illegal L2CAP frame sdu_length: %"PRIu16"\n",
+ channel->rx_buffer.sdu_length);
+ return;
+ }
+
/* do not use packetbuf_copyfrom here because the packetbuf_attr
* must not be cleared */
memcpy(packetbuf_dataptr(), channel->rx_buffer.sdu, channel->rx_buffer.sdu_length);
