Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7f6dfaf authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Merge "Fix an OOB write in SDP_AddAttribute" into tm-dev am: 45e8d2dc am: 695d4eab 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20813130



Change-Id: I423d02fa7cc19f70602d6f768f5cce975ad41679
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c5af8d62 695d4eab

system/stack/sdp/sdp_db.cc

+15 −5
Original line number Diff line number Diff line
@@ -355,6 +355,11 @@ bool SDP_AddAttribute(uint32_t handle, uint16_t attr_id, uint8_t attr_type, 
  uint16_t xx, yy, zz;

  tSDP_RECORD* p_rec = &sdp_cb.server_db.record[0];



  if (p_val == nullptr) {

    SDP_TRACE_WARNING("Trying to add attribute with p_val == nullptr, skipped");

    return (false);

  }



  if (sdp_cb.trace_level >= BT_TRACE_LEVEL_DEBUG) {

    if ((attr_type == UINT_DESC_TYPE) ||

        (attr_type == TWO_COMP_INT_DESC_TYPE) ||
@@ -402,6 +407,13 @@ bool SDP_AddAttribute(uint32_t handle, uint16_t attr_id, uint8_t attr_type, 
    if (p_rec->record_handle == handle) {

      tSDP_ATTRIBUTE* p_attr = &p_rec->attribute[0];



      // error out early, no need to look up

      if (p_rec->free_pad_ptr >= SDP_MAX_PAD_LEN) {

        SDP_TRACE_ERROR("the free pad for SDP record with handle %d is "

                        "full, skip adding the attribute", handle);

        return (false);

      }



      /* Found the record. Now, see if the attribute already exists */

      for (xx = 0; xx < p_rec->num_attributes; xx++, p_attr++) {

        /* The attribute exists. replace it */
@@ -440,15 +452,13 @@ bool SDP_AddAttribute(uint32_t handle, uint16_t attr_id, uint8_t attr_type, 
          attr_len = 0;

      }



      if ((attr_len > 0) && (p_val != 0)) {

      if (attr_len > 0) {

        p_attr->len = attr_len;

        memcpy(&p_rec->attr_pad[p_rec->free_pad_ptr], p_val, (size_t)attr_len);

        p_attr->value_ptr = &p_rec->attr_pad[p_rec->free_pad_ptr];

        p_rec->free_pad_ptr += attr_len;

      } else if ((attr_len == 0 &&

                  p_attr->len !=

                      0) || /* if truncate to 0 length, simply don't add */

                 p_val == 0) {

      } else if (attr_len == 0 && p_attr->len != 0) {

        /* if truncate to 0 length, simply don't add */

        SDP_TRACE_ERROR(

            "SDP_AddAttribute fail, length exceed maximum: ID %d: attr_len:%d ",

            attr_id, attr_len);