Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a7d2b4d authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Decrease length after reading from array in process_service_attr_req 

Test: compilation
Bug: 78136677
Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0
parent 3e5f576c

system/stack/sdp/sdp_server.cc

+2 −0
Original line number Diff line number Diff line
@@ -335,9 +335,11 @@ static void process_service_attr_req(tCONN_CB* p_ccb, uint16_t trans_num, 


  /* Extract the record handle */

  BE_STREAM_TO_UINT32(rec_handle, p_req);

  param_len -= sizeof(rec_handle);



  /* Get the max list length we can send. Cap it at MTU size minus overhead */

  BE_STREAM_TO_UINT16(max_list_len, p_req);

  param_len -= sizeof(max_list_len);



  if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN))

    max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;