commit acc18c223e2605efaf09b41b97d3756640b8bcac
author Jakub Pawlowski <jpawlowski@google.com> Tue May 29 16:25:56 2018 -0700
committer Ryan Longair <rlongair@google.com> Tue Jun 12 11:13:26 2018 -0700
tree 1b6db0faf6d4e1bd98b886ef80ffc00dc00abfde
parent 5e96a0bab6ed2229e013cc604d2a92eb93e3bb0c

Decrease length after reading from array in process_service_attr_req

Test: compilation
Bug: 78136677
Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0
Merged-In: I4807a350e2b4764a93f104ce88f23a957a7e85c0
(cherry picked from commit 76e962892ea1419f69e3c7e26a09fa77948c46e6)

stack/sdp/sdp_server.c

diff --git a/stack/sdp/sdp_server.c b/stack/sdp/sdp_server.c
index 2d34406..100d35b 100644
--- a/stack/sdp/sdp_server.c
+++ b/stack/sdp/sdp_server.c
@@ -351,9 +351,11 @@
 
     /* Extract the record handle */
     BE_STREAM_TO_UINT32 (rec_handle, p_req);
+    param_len -= sizeof(rec_handle);
 
     /* Get the max list length we can send. Cap it at MTU size minus overhead */
     BE_STREAM_TO_UINT16 (max_list_len, p_req);
+    param_len -= sizeof(max_list_len);
 
     if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN))
         max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;