Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88e2710b authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

Merge "Fix potential OOB access in sdp_db.cc" into udc-dev am: 5e3da511 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22977950



Change-Id: I66a97e3d390617f09dbc4205a0d5817b8dae3161
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 66de55d6 5e3da511

system/stack/sdp/sdp_db.cc

+8 −0
Original line number Diff line number Diff line
@@ -470,6 +470,14 @@ bool SDP_AddAttributeToRecord(tSDP_RECORD* p_rec, uint16_t attr_id, 
  p_attr->len = attr_len;



  if (p_rec->free_pad_ptr + attr_len >= SDP_MAX_PAD_LEN) {

    if (p_rec->free_pad_ptr >= SDP_MAX_PAD_LEN) {

      SDP_TRACE_ERROR(

          "SDP_AddAttributeToRecord failed: free pad %d equals or exceeds max "

          "padding length %d",

          p_rec->free_pad_ptr, SDP_MAX_PAD_LEN);

      return (false);

    }



    /* do truncate only for text string type descriptor */

    if (attr_type == TEXT_STR_DESC_TYPE) {

      SDP_TRACE_WARNING(