Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3611621d authored by Chen Chen's avatar Chen Chen Committed by Android (Google) Code Review
Browse files

Merge "Security: Add boundary check when reading SDP attribute response packet" into tm-dev

parents 48c9d27a dfe4d8d3

system/stack/sdp/sdp_discovery.cc

+5 −0
Original line number Diff line number Diff line
@@ -412,6 +412,11 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 
      return;

    }



    if (p_reply + list_byte_count + 1 /* continuation */ > p_reply_end) {

      sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);

      return;

    }



    if (p_ccb->rsp_list == NULL)

      p_ccb->rsp_list = (uint8_t*)osi_malloc(SDP_MAX_LIST_BYTE_COUNT);

    memcpy(&p_ccb->rsp_list[p_ccb->list_len], p_reply, list_byte_count);