diff --git a/stack/sdp/sdp_server.cc b/stack/sdp/sdp_server.cc
index d2bbd6c..510b8dc 100644
--- a/stack/sdp/sdp_server.cc
+++ b/stack/sdp/sdp_server.cc
@@ -421,6 +421,13 @@
       attr_len = sdpu_get_attrib_entry_len(p_attr);
       /* if there is a partial attribute pending to be sent */
       if (p_ccb->cont_info.attr_offset) {
+        if (attr_len < p_ccb->cont_info.attr_offset) {
+          android_errorWriteLog(0x534e4554, "79217770");
+          LOG(ERROR) << "offset is bigger than attribute length";
+          sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
+                                  SDP_TEXT_BAD_CONT_LEN);
+          return;
+        }
         p_rsp = sdpu_build_partial_attrib_entry(p_rsp, p_attr, rem_len,
                                                 &p_ccb->cont_info.attr_offset);
 
@@ -661,6 +668,13 @@
         attr_len = sdpu_get_attrib_entry_len(p_attr);
         /* if there is a partial attribute pending to be sent */
         if (p_ccb->cont_info.attr_offset) {
+          if (attr_len < p_ccb->cont_info.attr_offset) {
+            android_errorWriteLog(0x534e4554, "79217770");
+            LOG(ERROR) << "offset is bigger than attribute length";
+            sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
+                                    SDP_TEXT_BAD_CONT_LEN);
+            return;
+          }
           p_rsp = sdpu_build_partial_attrib_entry(
               p_rsp, p_attr, rem_len, &p_ccb->cont_info.attr_offset);