Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e1be2f7 authored by Android Build Merger (Role)'s avatar Android Build Merger (Role)
Browse files

[automerger] Fixes two bluetooth bugs causing remote overreads (2/2) am: cd26d8d6 

Change-Id: I9a8fc8c90e84297bde904dc30c31c745e0e15cbd
parents 72d84021 cd26d8d6

system/stack/sdp/sdp_discovery.c

+6 −1
Original line number Diff line number Diff line
@@ -358,7 +358,7 @@ static void process_service_search_rsp(tCONN_CB *p_ccb, UINT8 *p_reply, 
#if (SDP_RAW_DATA_INCLUDED == TRUE)

static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)

{

    unsigned int    cpy_len;

    unsigned int    cpy_len, rem_len;

    UINT32          list_len;

    UINT8           *p;

    UINT8           type;
@@ -389,6 +389,11 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset) 
        {

            cpy_len = list_len;

        }

        rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int)(p - &p_ccb->rsp_list[0]);

        if (cpy_len > rem_len) {

            SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);

            cpy_len = rem_len;

        }

#if (SDP_DEBUG_RAW == TRUE)

        SDP_TRACE_WARNING("list_len :%d cpy_len:%d raw_size:%d raw_used:%d",

            list_len, cpy_len, p_ccb->p_db->raw_size, p_ccb->p_db->raw_used);