Bluetooth: l2cap: fix null pointer dereference
bt_conn_create_pdu_timeout() may return NULL if no buffer
is available, l2cap_chan_create_seg() does not check the
subsequent return value.
Fix possible null pointer dereference in l2cap_chan_create_seg()
and l2cap_chan_le_send().
Signed-off-by: Johann Fischer <j.fischer@phytec.de>
diff --git a/subsys/bluetooth/host/l2cap.c b/subsys/bluetooth/host/l2cap.c
index 10b5b39..24d4b5f 100644
--- a/subsys/bluetooth/host/l2cap.c
+++ b/subsys/bluetooth/host/l2cap.c
@@ -1136,6 +1136,9 @@
segment:
seg = l2cap_alloc_seg(buf);
+ if (!seg) {
+ return NULL;
+ }
if (sdu_hdr_len) {
net_buf_add_le16(seg, net_buf_frags_len(buf));
@@ -1177,6 +1180,9 @@
}
seg = l2cap_chan_create_seg(ch, buf, sdu_hdr_len);
+ if (!seg) {
+ return -ENOMEM;
+ }
/* Channel may have been disconnected while waiting for a buffer */
if (!ch->chan.conn) {
