Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 72d84021 authored by Android Build Merger (Role)'s avatar Android Build Merger (Role)
Browse files

[automerger] Decrease length after reading from array in process_service_attr_req am: dc70c1e1 

Change-Id: I32728f7171047fc39b6d166bd6e13be053542c51
parents 27ad5901 dc70c1e1

system/stack/sdp/sdp_server.c

+2 −0
Original line number Diff line number Diff line
@@ -354,9 +354,11 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, 


    /* Extract the record handle */

    BE_STREAM_TO_UINT32 (rec_handle, p_req);

    param_len -= sizeof(rec_handle);



    /* Get the max list length we can send. Cap it at MTU size minus overhead */

    BE_STREAM_TO_UINT16 (max_list_len, p_req);

    param_len -= sizeof(max_list_len);



    if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN))

        max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;