1 files changed, 15 insertions, 2 deletions
diff --git a/src/android/bluetooth/client/map/BluetoothMapBmessageParser.java b/src/android/bluetooth/client/map/BluetoothMapBmessageParser.java
index fa3d817..ef75e7b 100644
--- a/src/android/bluetooth/client/map/BluetoothMapBmessageParser.java
+++ b/src/android/bluetooth/client/map/BluetoothMapBmessageParser.java
@@ -312,8 +312,16 @@ class BluetoothMapBmessageParser {
 
         prop = mParser.next(true);
 
-        if (prop != null && prop.equals(END_MSG)) {
-            mBmsg.mMessage = new String(data, 0, messageLen);
+        if (prop != null) {
+            if (prop.equals(END_MSG)) {
+                mBmsg.mMessage = new String(data, 0, messageLen);
+            } else {
+                /* Handle possible exception for incorrect LENGTH value
+                 * from MSE while parsing  GET Message response */
+                Log.e(TAG, "Prop Invalid: "+ prop.toString());
+                Log.e(TAG, "Possible Invalid LENGTH value");
+                throw expected(END_MSG);
+            }
         } else {
 
             data = null;
@@ -322,6 +330,11 @@ class BluetoothMapBmessageParser {
              * now we check if bMessage can be parsed if LENGTH is handled as
              * number of characters instead of number of bytes
              */
+            if (offset < 0 || offset > remng.length()) {
+                /* Handle possible exception for incorrect LENGTH value
+                 * from MSE while parsing  GET Message response */
+                throw new ParseException("Invalid LENGTH value", mParser.pos());
+            }
 
             Log.w(TAG, "byte LENGTH seems to be invalid, trying with char length");