commit 5163f6a2b72b074fa8f83e8398e57134e4c96b41
author Zongheng Wang <wangzongheng@google.com> Tue Aug 20 17:56:04 2019 -0700
committer Huizi Yang <yanghuiz@google.com> Tue Oct 08 14:05:06 2019 -0700
tree 20c5a30db31531eca35d5596aed13f7718d3a8e0
parent 762295665327e34be3f992ccd62469e7846b33de

SDP: Disconnect when there is a bad length

Handle the case when SDP_RAW_DATA_INCLUDED is FALSE.
Related to: I9f0df8b2de28970e7d69b737ce5d363785183bf3

Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I354494565005f2ca9093486546fc54c145066413
Merged-In: I354494565005f2ca9093486546fc54c145066413
(cherry picked from commit e45fe0a8ec678c73c57967b69c2fd485eef92927)
(cherry picked from commit 7f555a1a9b641a8e4892a4e7a7cc1ff294d8f2b7)

stack/sdp/sdp_discovery.cc

diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc
index 5667d43..b9b7bb1 100644
--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -715,6 +715,7 @@
   p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
   if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
     SDP_TRACE_WARNING("%s: bad length", __func__);
+    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
     return;
   }
   p_end = &p_ccb->rsp_list[p_ccb->list_len];