Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e775e16f authored by Zongheng Wang's avatar Zongheng Wang Committed by android-build-merger
Browse files

SDP: Disconnect when there is a bad length 

am: f704594f

Change-Id: Ia4da75e08758cda98a79bdd1f37be2480e36c71d
parents 98e490c0 f704594f

system/stack/sdp/sdp_discovery.cc

+1 −0
Original line number Original line Diff line number Diff line
@@ -713,6 +713,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 
  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);

  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);

  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {

  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {

    SDP_TRACE_WARNING("%s: bad length", __func__);

    SDP_TRACE_WARNING("%s: bad length", __func__);

    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);

    return;

    return;

  }

  }

  p_end = &p_ccb->rsp_list[p_ccb->list_len];

  p_end = &p_ccb->rsp_list[p_ccb->list_len];