SDP: disconnect if sdp_copy_raw_data fails am: 8e66b41dbf am: 98e490c05e am: aa006219db (9f1fadb3) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/sdp/sdp_discovery.cc

+16 −6

Original line number	Diff line number	Diff line
		@@ -334,11 +334,13 @@ static void process_service_search_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
		* Description copy the raw data
		*
		*
		* Returns void
		* Returns bool
		* true if successful
		* false if not copied
		*
		******************************************************************************/
		#if (SDP_RAW_DATA_INCLUDED == TRUE)
		static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
		static bool sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
		unsigned int cpy_len, rem_len;
		uint32_t list_len;
		uint8_t* p;
		@@ -358,11 +360,11 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
		p = sdpu_get_len_from_type(p, p_end, type, &list_len);
		if (p == NULL \|\| (p + list_len) > p_end) {
		SDP_TRACE_WARNING("%s: bad length", __func__);
		return;
		return false;
		}
		if ((int)cpy_len < (p - old_p)) {
		SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
		return;
		return false;
		}
		cpy_len -= (p - old_p);
		}
		@@ -377,6 +379,7 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
		memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
		p_ccb->p_db->raw_used += cpy_len;
		}
		return true;
		}
		#endif

		@@ -430,7 +433,11 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
		} else {
		#if (SDP_RAW_DATA_INCLUDED == TRUE)
		SDP_TRACE_WARNING("process_service_attr_rsp");
		sdp_copy_raw_data(p_ccb, false);
		if (!sdp_copy_raw_data(p_ccb, false)) {
		SDP_TRACE_ERROR("sdp_copy_raw_data failed");
		sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
		}

		#endif

		/* Save the response in the database. Stop on any error */
		@@ -632,7 +639,10 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,

		#if (SDP_RAW_DATA_INCLUDED == TRUE)
		SDP_TRACE_WARNING("process_service_search_attr_rsp");
		sdp_copy_raw_data(p_ccb, true);
		if (!sdp_copy_raw_data(p_ccb, true)) {
		SDP_TRACE_ERROR("sdp_copy_raw_data failed");
		sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
		}
		#endif

		p = &p_ccb->rsp_list[0];