提交: 08a5ae9e2c1b4f40206380cb120e34b791d90242 - system-bt (git)

system/bt

Commit MetaInfo

• 修訂: 08a5ae9e2c1b4f40206380cb120e34b791d90242 (tree)
• 時間: 2016-09-21 18:09:22
• 作者: Venkata Jagadeesh Garaga <vgaraga@code...>
• Commiter: Venkata Jagadeesh Garaga

Log Message

SDP: Crash in sdp due to invalid length

Crashed in memcpy as there is no boundary check
for copy length and length exceeds the allocated
buffer size.

Align copy length with source buffer offset
so that copy length will be in boundary of the
allocated buffer size

Change-Id: I4a2e429484378d23c996caffb6495407793548d2
CRs-Fixed: 1069198

Change Summary

• modified: stack/sdp/sdp_discovery.c

差異

--- a/stack/sdp/sdp_discovery.c
+++ b/stack/sdp/sdp_discovery.c
@@ -347,7 +347,7 @@ static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
 static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
 {
-    unsigned int    cpy_len;
+    unsigned int    cpy_len, rem_len;
     UINT32          list_len;
     UINT8           *p;
     UINT8           type;
@@ -378,6 +378,12 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
         {
             cpy_len = list_len;
         }
+        rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int) (p - &p_ccb->rsp_list[0]);
+        if (cpy_len > rem_len)
+        {
+            SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);
+            cpy_len = rem_len;
+        }
 #if (SDP_DEBUG_RAW == TRUE)
         SDP_TRACE_WARNING("list_len :%d cpy_len:%d raw_size:%d raw_used:%d",
             list_len, cpy_len, p_ccb->p_db->raw_size, p_ccb->p_db->raw_used);