commit 8496cf1978106f11775758d868ef7fb5373658dd
author Andre Eisenbach <eisenbach@google.com> Tue Aug 08 15:41:21 2017 -0700
committer Nikoli Cartagena <dargeren@google.com> Wed Sep 20 12:22:59 2017 -0700
tree ac56c1f03f6b14895c538d4ca5c5307fce1f4f9a
parent 42dc9df90fd5db41cd477d6b3856197a3eba88ea

SDP: Bounds check 'id' parameter for free_sdp_slot()

Merged-In: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7

Test: manual
Fixes: 37502513
Change-Id: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7
(cherry picked from commit b413f1b1365af4273647727e497848f95312d0ec)
(cherry picked from commit 82e4754aaafe820619a51f8eeaa858db8735d9c1)

btif/src/btif_sdp_server.c

diff --git a/btif/src/btif_sdp_server.c b/btif/src/btif_sdp_server.c
index d02dfa0..90d74cf 100644
--- a/btif/src/btif_sdp_server.c
+++ b/btif/src/btif_sdp_server.c
@@ -215,7 +215,8 @@
 static int free_sdp_slot(int id) {
     int handle = -1;
     bluetooth_sdp_record* record = NULL;
-    if(id >= MAX_SDP_SLOTS) {
+    if(id < 0 || id >= MAX_SDP_SLOTS) {
+        android_errorWriteLog(0x534e4554, "37502513");
         APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
         return handle;
     }