Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5e3da511 authored by Brian Delwiche's avatar Brian Delwiche Committed by Android (Google) Code Review
Browse files

Merge "Fix potential OOB access in sdp_db.cc" into udc-dev

parents ffe74009 4c75ecea

system/stack/sdp/sdp_db.cc

+8 −0
Original line number Original line Diff line number Diff line
@@ -470,6 +470,14 @@ bool SDP_AddAttributeToRecord(tSDP_RECORD* p_rec, uint16_t attr_id, 
  p_attr->len = attr_len;

  p_attr->len = attr_len;





  if (p_rec->free_pad_ptr + attr_len >= SDP_MAX_PAD_LEN) {

  if (p_rec->free_pad_ptr + attr_len >= SDP_MAX_PAD_LEN) {

    if (p_rec->free_pad_ptr >= SDP_MAX_PAD_LEN) {

      SDP_TRACE_ERROR(

          "SDP_AddAttributeToRecord failed: free pad %d equals or exceeds max "

          "padding length %d",

          p_rec->free_pad_ptr, SDP_MAX_PAD_LEN);

      return (false);

    }



    /* do truncate only for text string type descriptor */

    /* do truncate only for text string type descriptor */

    if (attr_type == TEXT_STR_DESC_TYPE) {

    if (attr_type == TEXT_STR_DESC_TYPE) {

      SDP_TRACE_WARNING(

      SDP_TRACE_WARNING(