Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a08618ee authored by venkata Jagadeesh's avatar venkata Jagadeesh Committed by Andre Eisenbach
Browse files

SDP: Restrict attribute length to SDP_MAX_ATTR_LEN 

Use case:
Bluetooth crash during the SNS testing.

Root Cause:
In sdpu_build_partial_attrib_entry there is no length check, it can
exceed the maximum allowable value and lead to a crash in memcpy.

Fix:
Restrict remaining attribute length to SDP_MAX_ATTR_LEN
in sdpu_build_partial_attrib_entry.

Change-Id: I5bde6868b82e50b3c09cf94277dabb4862f0a2a8
parent 924faa96

system/stack/sdp/sdp_utils.c

+8 −8
Original line number Diff line number Diff line
@@ -999,18 +999,18 @@ UINT16 sdpu_get_attrib_entry_len(tSDP_ATTRIBUTE *p_attr) 
*******************************************************************************/

UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UINT16 len, UINT16 *offset)

{

    UINT8 *p_tmp_attr;

    size_t len_to_copy;

    UINT16 attr_len;

    UINT8 *p_attr_buff = (UINT8 *)osi_malloc(sizeof(UINT8) * SDP_MAX_ATTR_LEN);

    sdpu_build_attrib_entry(p_attr_buff, p_attr);



    p_tmp_attr = p_attr_buff;

    UINT16 attr_len = sdpu_get_attrib_entry_len(p_attr);



    sdpu_build_attrib_entry(p_tmp_attr, p_attr);

    attr_len = sdpu_get_attrib_entry_len(p_attr);



    len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset): len;

    if (len > SDP_MAX_ATTR_LEN)

    {

        SDP_TRACE_ERROR("%s len %d exceeds SDP_MAX_ATTR_LEN", __func__, len);

        len = SDP_MAX_ATTR_LEN;

    }



    size_t len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset) : len;

    memcpy(p_out, &p_attr_buff[*offset], len_to_copy);



    p_out = &p_out[len_to_copy];