Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

bluedroid: Add continuation offset check to SDP server

Browse source 
Fix for CVE-2017-0785
https://android.googlesource.com/platform/system/bt/+/818cf6f%5E%21/#F0
This commit is contained in:
Angus Gratton 2017-09-27 09:49:04 +10:00 committed by Angus Gratton
parent 00b5f82c41
commit 43b25e2a2f
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
components/bt/bluedroid/stack/sdp/sdp_server.c
View file

@ -223,7 +223,7 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
}
BE_STREAM_TO_UINT16 (cont_offset, p_req);
if (cont_offset != p_ccb->cont_offset) {
if (cont_offset != p_ccb->cont_offset || num_rsp_handles < cont_offset) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE,
SDP_TEXT_BAD_CONT_INX);
return;