commit 5686cbc1df02e451088a202ed45d03fbf4cc8746
author Andre Eisenbach <eisenbach@google.com> Tue Aug 08 15:41:21 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu Sep 21 23:23:48 2017 +0000
tree 889a8e1994c6d52157d80d80d158ebdfdc73b621
parent c01e7fbedd8d82ce4c6ecb2f24e89045f09ae696

SDP: Bounds check 'id' parameter for free_sdp_slot()

Test: manual
Fixes: 37502513
Change-Id: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7
(cherry picked from commit b413f1b1365af4273647727e497848f95312d0ec)

btif/src/btif_sdp_server.cc

diff --git a/btif/src/btif_sdp_server.cc b/btif/src/btif_sdp_server.cc
index 43d489b..b84d694 100644
--- a/btif/src/btif_sdp_server.cc
+++ b/btif/src/btif_sdp_server.cc
@@ -214,7 +214,8 @@
 static int free_sdp_slot(int id) {
   int handle = -1;
   bluetooth_sdp_record* record = NULL;
-  if (id >= MAX_SDP_SLOTS) {
+  if (id < 0 || id >= MAX_SDP_SLOTS) {
+    android_errorWriteLog(0x534e4554, "37502513");
     APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
     return handle;
   }