Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit beebc8ec authored by akirilov's avatar akirilov Committed by Atanas Kirilov
Browse files

RESTRICT AUTOMERGE: Fixes two bluetooth causing remote overreads (2/2) 

Bug: 74075873
Test: manual
Change-Id: I76058b11c90dc40b78f26fb64b74d609f3473f5d
parent 39ab1e16

system/stack/sdp/sdp_discovery.c

+6 −1
Original line number Diff line number Diff line
@@ -353,7 +353,7 @@ static void process_service_search_rsp(tCONN_CB *p_ccb, UINT8 *p_reply, 
#if (SDP_RAW_DATA_INCLUDED == TRUE)

static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)

{

    unsigned int    cpy_len;

    unsigned int    cpy_len, rem_len;

    UINT32          list_len;

    UINT8           *p;

    UINT8           type;
@@ -384,6 +384,11 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset) 
        {

            cpy_len = list_len;

        }

        rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int)(p - &p_ccb->rsp_list[0]);

        if (cpy_len > rem_len) {

            SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);

            cpy_len = rem_len;

        }

        SDP_TRACE_WARNING(

          "%s: list_len:%d cpy_len:%d p:%p p_ccb:%p p_db:%p raw_size:%d "

          "raw_used:%d raw_data:%p",