Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 65c12ac1 authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Fix copy length calculation in sdp_copy_raw_data 

Test: compilation
Bug: 110216176
Change-Id: Ic4a19c9f0fe8cd592bc6c25dcec7b1da49ff7459
parent eadeb92e

system/stack/sdp/sdp_discovery.cc

+7 −0
Original line number Diff line number Diff line
@@ -352,8 +352,15 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) { 
    p = &p_ccb->rsp_list[0];



    if (offset) {

      cpy_len -= 1;

      type = *p++;

      uint8_t* old_p = p;

      p = sdpu_get_len_from_type(p, type, &list_len);

      if ((int)cpy_len < (p - old_p)) {

        SDP_TRACE_WARNING("%s: no bytes left for data", __func__);

        return;

      }

      cpy_len -= (p - old_p);

    }

    if (list_len < cpy_len) {

      cpy_len = list_len;