diff options
| author | venkata Jagadeesh <vjagad@codeaurora.org> | 2015-12-15 13:00:01 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2015-12-25 23:30:43 -0800 |
| commit | 9adcc67297dacc2dd93af30964c82f6cc65bf120 (patch) | |
| tree | 769963be33c0421af2a4b337218f550ab543f2b1 /stack/sdp/sdp_utils.c | |
| parent | 1265afd4c6574e0432cdadca6bde3b8a58740d46 (diff) | |
| download | android_system_bt-9adcc67297dacc2dd93af30964c82f6cc65bf120.tar.gz android_system_bt-9adcc67297dacc2dd93af30964c82f6cc65bf120.tar.bz2 android_system_bt-9adcc67297dacc2dd93af30964c82f6cc65bf120.zip | |
Bluetooth :SDP :Restrict rem attr length to SDP_MAX_ATTR_LEN
Restrict remaining attribute length to SDP_MAX_ATTR_LEN
in sdpu_build_partial_attrib_entry as there is no check
for length parameter,it can exceed max value
Change-Id: I5bde6868b82e50b3c09cf94277dabb4862f0a2a8
CRs-Fixed: 954622
Diffstat (limited to 'stack/sdp/sdp_utils.c')
| -rw-r--r-- | stack/sdp/sdp_utils.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/stack/sdp/sdp_utils.c b/stack/sdp/sdp_utils.c index 5c8d73312..d9b1ea7ef 100644 --- a/stack/sdp/sdp_utils.c +++ b/stack/sdp/sdp_utils.c @@ -1027,6 +1027,11 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI sdpu_build_attrib_entry(p_tmp_attr, p_attr); attr_len = sdpu_get_attrib_entry_len(p_attr); + if (len > SDP_MAX_ATTR_LEN) + { + SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry len %d exceeds SDP_MAX_ATTR_LEN",len); + len = SDP_MAX_ATTR_LEN; + } len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset): len; if(p_out) { |