commit 1a35f52534579014467deaaaa6be22c711119e1c
author Jakub Pawlowski <jpawlowski@google.com> Tue May 29 16:17:32 2018 -0700
committer Ryan Longair <rlongair@google.com> Tue Jun 12 11:27:18 2018 -0700
tree 1a9498e11589ce21e26789f6fbd618513c807db5
parent 8a6aa11bbc0780410e66b975e9756ab6ba41de7e

Decrease length after reading from array in process_service_attr_req

Test: compilation
Bug: 78136677
Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0
(cherry picked from commit 6cd2e8bf6e5707e8e77e7aca6519c58200ee58db)

stack/sdp/sdp_server.cc

diff --git a/stack/sdp/sdp_server.cc b/stack/sdp/sdp_server.cc
index e4ed60a..121c248a 100644
--- a/stack/sdp/sdp_server.cc
+++ b/stack/sdp/sdp_server.cc
@@ -333,9 +333,11 @@
 
   /* Extract the record handle */
   BE_STREAM_TO_UINT32(rec_handle, p_req);
+  param_len -= sizeof(rec_handle);
 
   /* Get the max list length we can send. Cap it at MTU size minus overhead */
   BE_STREAM_TO_UINT16(max_list_len, p_req);
+  param_len -= sizeof(max_list_len);
 
   if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN))
     max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;