commit 226ea26684d4cd609a5b456d3d2cc762453c2d75
author Pavlin Radoslavov <pavlin@google.com> Fri Jul 07 17:17:31 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Tue Aug 08 18:44:57 2017 +0000
tree 3b25ff41a6485b3c3cdb75b6aa0aba813a835301
parent 1e77fefc8b9c832239e1b32c6a6880376065e24e

Add missing continuation offset check for SDP continuation requests

Bug: 63146698
Test: External script
Change-Id: Iea52f1689dc12bfe0d4b57996f17db4bc3bd5983
Merged-In: Iea52f1689dc12bfe0d4b57996f17db4bc3bd5983
(cherry picked from commit e776c834768bedd043ace7e5714390b61c96a248)

stack/sdp/sdp_server.cc

diff --git a/stack/sdp/sdp_server.cc b/stack/sdp/sdp_server.cc
index fe67be1..24a168c 100644
--- a/stack/sdp/sdp_server.cc
+++ b/stack/sdp/sdp_server.cc
@@ -218,7 +218,7 @@
     }
     BE_STREAM_TO_UINT16(cont_offset, p_req);
 
-    if (cont_offset != p_ccb->cont_offset) {
+    if (cont_offset != p_ccb->cont_offset || num_rsp_handles < cont_offset) {
       sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
                               SDP_TEXT_BAD_CONT_INX);
       return;