commit 3af7c23df387bd8b89879c13ae15f4e04177ac9c
author Jakub Pawlowski <jpawlowski@google.com> Thu May 24 08:59:34 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Aug 10 20:30:34 2018 +0000
tree e56b8deacb58abfab60c0d7c0525ff219ac6a241
parent 89ad038f3dd7f767c03eeaee3b8ec8e9cffa2e21

Add PDU size checks in process_service_search_attr_rsp

Bug: 79884292
Change-Id: Icc02a6188f806f766aa8676804d74995afa08d25
Merged-In: Icc02a6188f806f766aa8676804d74995afa08d25
(cherry picked from commit 980f6427b183e013958acd6b70e91f58177408a6)

stack/sdp/sdp_discovery.cc

diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc
index 7eea5fd..b259157 100644
--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -531,6 +531,13 @@
 #endif
   /* If p_reply is NULL, we were called for the initial read */
   if (p_reply) {
+    if (p_reply + 4 /* transaction ID and length */ + sizeof(lists_byte_count) >
+        p_reply_end) {
+      android_errorWriteLog(0x534e4554, "79884292");
+      sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);
+      return;
+    }
+
 #if (SDP_DEBUG_RAW == TRUE)
     SDP_TRACE_WARNING("ID & len: 0x%02x-%02x-%02x-%02x", p_reply[0], p_reply[1],
                       p_reply[2], p_reply[3]);
@@ -554,6 +561,13 @@
     SDP_TRACE_WARNING("list_len: %d, list_byte_count: %d", p_ccb->list_len,
                       lists_byte_count);
 #endif
+
+    if (p_reply + lists_byte_count + 1 /* continuation */ > p_reply_end) {
+      android_errorWriteLog(0x534e4554, "79884292");
+      sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);
+      return;
+    }
+
     if (p_ccb->rsp_list == NULL)
       p_ccb->rsp_list = (uint8_t*)osi_malloc(SDP_MAX_LIST_BYTE_COUNT);
     memcpy(&p_ccb->rsp_list[p_ccb->list_len], p_reply, lists_byte_count);