Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 412891b3 authored by Hansong Zhang's avatar Hansong Zhang
Browse files

Fix unexpected behavior in SDP 

Bug: 68776054
Bug: 68817966
Test: Bluetooth SDP still works
Change-Id: I4eef22679a313b88d7e8ec463b29dbb592c6b5b9
parent df1bdf7a

system/stack/sdp/sdp_server.cc

+14 −0
Original line number Diff line number Diff line
@@ -23,6 +23,8 @@ 
 *

 ******************************************************************************/



#include <cutils/log.h>



#include <stdio.h>

#include <stdlib.h>

#include <string.h>
@@ -343,6 +345,12 @@ static void process_service_attr_req(tCONN_CB* p_ccb, uint16_t trans_num, 
    return;

  }



  if (max_list_len < 4) {

    sdpu_build_n_send_error(p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);

    android_errorWriteLog(0x534e4554, "68776054");

    return;

  }



  /* Free and reallocate buffer */

  osi_free(p_ccb->rsp_list);

  p_ccb->rsp_list = (uint8_t*)osi_malloc(max_list_len);
@@ -553,6 +561,12 @@ static void process_service_search_attr_req(tCONN_CB* p_ccb, uint16_t trans_num, 


  memcpy(&attr_seq_sav, &attr_seq, sizeof(tSDP_ATTR_SEQ));



  if (max_list_len < 4) {

    sdpu_build_n_send_error(p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);

    android_errorWriteLog(0x534e4554, "68817966");

    return;

  }



  /* Free and reallocate buffer */

  osi_free(p_ccb->rsp_list);

  p_ccb->rsp_list = (uint8_t*)osi_malloc(max_list_len);