commit ea8f16553004bdd052de1b6fc5ed0a74f0e7ad67
author Jakub Pawlowski <jpawlowski@google.com> Mon Jul 16 06:40:35 2018 -0700
committer Ryan Longair <rlongair@google.com> Wed Aug 15 15:28:27 2018 -0700
tree 54edd01da332d5452007ce350bb67b51d4044972
parent d065250225b737ed77bbcbf2acb66ed87f28d649

Fix copy length calculation in sdp_copy_raw_data

Test: compilation
Bug: 110216176
Change-Id: Ic4a19c9f0fe8cd592bc6c25dcec7b1da49ff7459
Merged-In: Ic4a19c9f0fe8cd592bc6c25dcec7b1da49ff7459
(cherry picked from commit 1a0571a4aca9d597a8f79665aa220decf0d45ce1)

stack/sdp/sdp_discovery.c

diff --git a/stack/sdp/sdp_discovery.c b/stack/sdp/sdp_discovery.c
index 0beb04c..6402b79 100644
--- a/stack/sdp/sdp_discovery.c
+++ b/stack/sdp/sdp_discovery.c
@@ -377,8 +377,15 @@
 
         if(offset)
         {
+            cpy_len -= 1;
             type = *p++;
+            uint8_t* old_p = p;
             p = sdpu_get_len_from_type (p, type, &list_len);
+            if ((int)cpy_len < (p - old_p)) {
+                SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
+                return;
+            }
+            cpy_len -= (p - old_p);
         }
         if(list_len < cpy_len )
         {