Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eef1b41c authored by Zongheng Wang's avatar Zongheng Wang
Browse files

SDP: Disconnect when there is a bad length 

Handle the case when SDP_RAW_DATA_INCLUDED is FALSE.
Related to: I9f0df8b2de28970e7d69b737ce5d363785183bf3

Bug: 137239831
Test: manual test
Change-Id: I354494565005f2ca9093486546fc54c145066413
parent 9a6f38e7

system/stack/sdp/sdp_discovery.cc

+1 −0
Original line number Original line Diff line number Diff line
@@ -657,6 +657,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, 
  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);

  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);

  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {

  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {

    SDP_TRACE_WARNING("%s: bad length", __func__);

    SDP_TRACE_WARNING("%s: bad length", __func__);

    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);

    return;

    return;

  }

  }

  p_end = &p_ccb->rsp_list[p_ccb->list_len];

  p_end = &p_ccb->rsp_list[p_ccb->list_len];