diff options
| author | Jakub Pawlowski <jpawlowski@google.com> | 2018-05-29 16:17:32 -0700 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2018-08-08 21:34:32 +0200 |
| commit | 06cca56e23f0ebcd95be47c3866f71d64ab34e07 (patch) | |
| tree | 5045b75cb20b86da7175b3c136f7bf33d2395842 | |
| parent | 56ead56367c8352c6ff90b7f1116a5f57d6f66fa (diff) | |
| download | android_system_bt-06cca56e23f0ebcd95be47c3866f71d64ab34e07.tar.gz android_system_bt-06cca56e23f0ebcd95be47c3866f71d64ab34e07.tar.bz2 android_system_bt-06cca56e23f0ebcd95be47c3866f71d64ab34e07.zip | |
Decrease length after reading from array in process_service_attr_req
Test: compilation
Bug: 78136677
Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0
(cherry picked from commit 6cd2e8bf6e5707e8e77e7aca6519c58200ee58db)
| -rw-r--r-- | stack/sdp/sdp_server.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/stack/sdp/sdp_server.c b/stack/sdp/sdp_server.c index b7ef7ee99..3ed9299a0 100644 --- a/stack/sdp/sdp_server.c +++ b/stack/sdp/sdp_server.c @@ -601,9 +601,11 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* Extract the record handle */ BE_STREAM_TO_UINT32 (rec_handle, p_req); + param_len -= sizeof(rec_handle); /* Get the max list length we can send. Cap it at MTU size minus overhead */ BE_STREAM_TO_UINT16 (max_list_len, p_req); + param_len -= sizeof(max_list_len); if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN)) max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN; |