[PATCH BlueZ 1/2] emulator: bthost: don't crash on ecred_conn_req with too many scid

[Pauli Virtanen <pav@iki.fi>]

l2cap_ecred_conn_req() crashes if the request contains more SCID than
specification allows (5).

Respond 0x000C - All connections refused – invalid parameters to such
invalid requests.
---
 emulator/bthost.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/emulator/bthost.c b/emulator/bthost.c
index 46c6a52f5..d23b709ea 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -2607,6 +2607,13 @@ static bool l2cap_ecred_conn_req(struct bthost *bthost, struct btconn *conn,
 	len -= sizeof(rsp.pdu);
 	num_scid = len / sizeof(*req->scid);
 
+	if (num_scid > (int)ARRAY_SIZE(rsp.dcid)) {
+		rsp.pdu.result = cpu_to_le16(0x000c); /* Refuse all - Invalid */
+		bthost_debug(bthost, "invalid ECRED_CONN_REQ (num_scid = %d)",
+								num_scid);
+		goto respond;
+	}
+
 	for (; i < num_scid; i++)
 		rsp.dcid[i] = cpu_to_le16(conn->next_cid++);
 
-- 
2.55.0