Fix incorrect logging in sdp_server In the function process_service_search_attr_req of sdp_server.cc, a log statement uses a structure that may, in exceptional cases, have been freed by preceding calls. This can lead to use after free and potentially to security vulnerabilities. Use local variables instead. Bug: 375407167 Test: m libbluetooth Test: researcher POC Flag: EXEMPT trivial logic fix Ignore-AOSP-First: security Tag: #security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f23300552c43a4f503debcf0236f29211ee1c557) Merged-In: I1037e592ab8910eeae5c28a41a53a2fc60a298d8 Change-Id: I1037e592ab8910eeae5c28a41a53a2fc60a298d8
diff --git a/system/stack/sdp/sdp_server.cc b/system/stack/sdp/sdp_server.cc index 0b2012e..2a127b7 100644 --- a/system/stack/sdp/sdp_server.cc +++ b/system/stack/sdp/sdp_server.cc
@@ -1181,7 +1181,7 @@ /* Send the buffer through L2CAP */ if (L2CA_DataWrite(p_ccb->connection_id, p_buf) != L2CAP_DW_SUCCESS) { log::warn("Unable to write L2CAP data peer:{} cid:{} len:{}", - p_ccb->device_address, p_ccb->connection_id, p_buf->len); + p_ccb->device_address, p_ccb->connection_id, p_rsp - p_rsp_start); } }