Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfe4d8d3 authored by Chen Chen's avatar Chen Chen
Browse files

Security: Add boundary check when reading SDP attribute response packet 

Bug: 206478022
Test: build
Tag: #security
Change-Id: Icc8ceba7fa0f8b0d4540c3fde5829bae5d1c670d
parent 9c221171

system/stack/sdp/sdp_discovery.cc

+5 −0
Original line number Diff line number Diff line
@@ -412,6 +412,11 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 
      return;

    }



    if (p_reply + list_byte_count + 1 /* continuation */ > p_reply_end) {

      sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);

      return;

    }



    if (p_ccb->rsp_list == NULL)

      p_ccb->rsp_list = (uint8_t*)osi_malloc(SDP_MAX_LIST_BYTE_COUNT);

    memcpy(&p_ccb->rsp_list[p_ccb->list_len], p_reply, list_byte_count);