Commit: 5771119d00fdbaba7601fa7180a348fd7a67ff85 - system-bt (git)

system/bt

Commit MetaInfo

• Revision: 5771119d00fdbaba7601fa7180a348fd7a67ff85 (tree)
• Time: 2019-09-28 06:52:22
• Author: Zongheng Wang <wangzongheng@goog...>
• Commiter: android-build-merger

Log Message

SDP: Disconnect when there is a bad length am: 7f555a1a9b am: 325d1539ba am: 23bcf92253 am: 736669e4a5
am: 4a8fc7789e

Change-Id: Iee49e1f37dd060b3d9bc014dca272273082ec354

Change Summary

• modified: stack/sdp/sdp_discovery.cc

Incremental Difference

--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -657,6 +657,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
   p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
   if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
     SDP_TRACE_WARNING("%s: bad length", __func__);
+    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
     return;
   }
   p_end = &p_ccb->rsp_list[p_ccb->list_len];