Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dc70c1e1 authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Decrease length after reading from array in process_service_attr_req 

Test: compilation
Bug: 78136677
Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0
Merged-In: I4807a350e2b4764a93f104ce88f23a957a7e85c0
parent 9d2bbea2

system/stack/sdp/sdp_server.c

+2 −0
Original line number Diff line number Diff line
@@ -354,9 +354,11 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, 


    /* Extract the record handle */

    BE_STREAM_TO_UINT32 (rec_handle, p_req);

    param_len -= sizeof(rec_handle);



    /* Get the max list length we can send. Cap it at MTU size minus overhead */

    BE_STREAM_TO_UINT16 (max_list_len, p_req);

    param_len -= sizeof(max_list_len);



    if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN))

        max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;