Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e775e16f authored by Zongheng Wang's avatar Zongheng Wang Committed by android-build-merger
Browse files

SDP: Disconnect when there is a bad length

am: f704594f

Change-Id: Ia4da75e08758cda98a79bdd1f37be2480e36c71d
parents 98e490c0 f704594f
Loading
Loading
Loading
Loading
+1 −0
Original line number Original line Diff line number Diff line
@@ -713,6 +713,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
    SDP_TRACE_WARNING("%s: bad length", __func__);
    SDP_TRACE_WARNING("%s: bad length", __func__);
    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
    return;
    return;
  }
  }
  p_end = &p_ccb->rsp_list[p_ccb->list_len];
  p_end = &p_ccb->rsp_list[p_ccb->list_len];