Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0676e41a authored by Zongheng Wang's avatar Zongheng Wang Committed by android-build-merger
Browse files

SDP: disconnect if sdp_copy_raw_data fails am: 8e66b41d am: 98e490c0 

am: aa006219

Change-Id: I7c4e10c31d265a7f7cef79a938078376d3a7c16d
parents 2e67a7f3 aa006219

system/stack/sdp/sdp_discovery.cc

+16 −6
Original line number Original line Diff line number Diff line
@@ -341,11 +341,13 @@ static void process_service_search_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 
 * Description      copy the raw data

 * Description      copy the raw data

 *

 *

 *

 *

 * Returns          void

 * Returns          bool

 *                          true if successful

 *                          false if not copied

 *

 *

 ******************************************************************************/

 ******************************************************************************/

#if (SDP_RAW_DATA_INCLUDED == TRUE)

#if (SDP_RAW_DATA_INCLUDED == TRUE)

static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {

static bool sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {

  unsigned int cpy_len, rem_len;

  unsigned int cpy_len, rem_len;

  uint32_t list_len;

  uint32_t list_len;

  uint8_t* p;

  uint8_t* p;
@@ -376,11 +378,11 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) { 
      p = sdpu_get_len_from_type(p, p_end, type, &list_len);

      p = sdpu_get_len_from_type(p, p_end, type, &list_len);

      if (p == NULL || (p + list_len) > p_end) {

      if (p == NULL || (p + list_len) > p_end) {

        SDP_TRACE_WARNING("%s: bad length", __func__);

        SDP_TRACE_WARNING("%s: bad length", __func__);

        return;

        return false;

      }

      }

      if ((int)cpy_len < (p - old_p)) {

      if ((int)cpy_len < (p - old_p)) {

        SDP_TRACE_WARNING("%s: no bytes left for data", __func__);

        SDP_TRACE_WARNING("%s: no bytes left for data", __func__);

        return;

        return false;

      }

      }

      cpy_len -= (p - old_p);

      cpy_len -= (p - old_p);

    }

    }
@@ -400,6 +402,7 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) { 
    memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);

    memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);

    p_ccb->p_db->raw_used += cpy_len;

    p_ccb->p_db->raw_used += cpy_len;

  }

  }

  return true;

}

}

#endif

#endif
@@ -468,7 +471,11 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 
    } else {

    } else {

#if (SDP_RAW_DATA_INCLUDED == TRUE)

#if (SDP_RAW_DATA_INCLUDED == TRUE)

      SDP_TRACE_WARNING("process_service_attr_rsp");

      SDP_TRACE_WARNING("process_service_attr_rsp");

      sdp_copy_raw_data(p_ccb, false);

      if (!sdp_copy_raw_data(p_ccb, false)) {

        SDP_TRACE_ERROR("sdp_copy_raw_data failed");

        sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);

      }



#endif

#endif





      /* Save the response in the database. Stop on any error */

      /* Save the response in the database. Stop on any error */
@@ -693,7 +700,10 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 




#if (SDP_RAW_DATA_INCLUDED == TRUE)

#if (SDP_RAW_DATA_INCLUDED == TRUE)

  SDP_TRACE_WARNING("process_service_search_attr_rsp");

  SDP_TRACE_WARNING("process_service_search_attr_rsp");

  sdp_copy_raw_data(p_ccb, true);

  if (!sdp_copy_raw_data(p_ccb, true)) {

    SDP_TRACE_ERROR("sdp_copy_raw_data failed");

    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);

  }

#endif

#endif





  p = &p_ccb->rsp_list[0];

  p = &p_ccb->rsp_list[0];