[PATCH BlueZ v3 1/4] btio: fix range validation of security level

[Ismagil Iskakov <i.iskakov@xxxxxx>]

Arrays inside l2cap_set_lm/rfcomm_set_lm functions are of size 4,
but the bounds check allows the value 4 for 'level'.
---
 btio/btio.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/btio/btio.c b/btio/btio.c
index b8afe0580..bc14199f2 100644
--- a/btio/btio.c
+++ b/btio/btio.c
@@ -474,6 +474,12 @@ static gboolean set_sec_level(int sock, BtIOType type, int level, GError **err)
 		return FALSE;
 	}
 
+	if (level == BT_SECURITY_FIPS) {
+		g_set_error(err, BT_IO_ERROR, EINVAL,
+				"FIPS security level is not supported for L2CAP_LM/RFCOMM_LM");
+		return FALSE;
+	}
+
 	if (type == BT_IO_L2CAP)
 		ret = l2cap_set_lm(sock, level);
 	else
-- 
2.34.1