diff options
| author | Zongheng Wang <wangzongheng@google.com> | 2019-09-27 14:24:46 -0700 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-09-27 14:24:46 -0700 |
| commit | 325d1539ba82a57bf8c7998d4813f9ff7940bfa5 (patch) | |
| tree | 24b7f702ee359aaae17b2286598a289e8c7f659c | |
| parent | e6bda7c73b328dc03f041fed9750c0510f8d5225 (diff) | |
| parent | 7f555a1a9b641a8e4892a4e7a7cc1ff294d8f2b7 (diff) | |
| download | android_system_bt-325d1539ba82a57bf8c7998d4813f9ff7940bfa5.tar.gz android_system_bt-325d1539ba82a57bf8c7998d4813f9ff7940bfa5.tar.bz2 android_system_bt-325d1539ba82a57bf8c7998d4813f9ff7940bfa5.zip | |
SDP: Disconnect when there is a bad length
am: 7f555a1a9b
Change-Id: Ia4da75e08758cda98a79bdd1f37be2480e36c71d
| -rw-r--r-- | stack/sdp/sdp_discovery.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc index b1f85880d..3f9972d36 100644 --- a/stack/sdp/sdp_discovery.cc +++ b/stack/sdp/sdp_discovery.cc @@ -713,6 +713,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len); if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) { SDP_TRACE_WARNING("%s: bad length", __func__); + sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER); return; } p_end = &p_ccb->rsp_list[p_ccb->list_len]; |