commit dfe4d8d3acb6d22f8287d943f0c0f3d5d62dfd86
author Chen Chen <cncn@google.com> Mon Apr 11 15:56:33 2022 -0700
committer Chen Chen <cncn@google.com> Mon Apr 11 22:59:14 2022 +0000
tree 5c2afa7f52b7f4c83e2cf1f4c38317bd5decd248
parent 9c2211718cf576918a193002f823741b45a3b81e

Security: Add boundary check when reading SDP attribute response packet

Bug: 206478022
Test: build
Tag: #security
Change-Id: Icc8ceba7fa0f8b0d4540c3fde5829bae5d1c670d

system/stack/sdp/sdp_discovery.cc

diff --git a/system/stack/sdp/sdp_discovery.cc b/system/stack/sdp/sdp_discovery.cc
index 510e811..3a3bacf 100644
--- a/system/stack/sdp/sdp_discovery.cc
+++ b/system/stack/sdp/sdp_discovery.cc
@@ -412,6 +412,11 @@
       return;
     }
 
+    if (p_reply + list_byte_count + 1 /* continuation */ > p_reply_end) {
+      sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);
+      return;
+    }
+
     if (p_ccb->rsp_list == NULL)
       p_ccb->rsp_list = (uint8_t*)osi_malloc(SDP_MAX_LIST_BYTE_COUNT);
     memcpy(&p_ccb->rsp_list[p_ccb->list_len], p_reply, list_byte_count);