bluedroid: Add continuation offset check to SDP server

Fix for CVE-2017-0785
https://android.googlesource.com/platform/system/bt/+/818cf6f%5E%21/#F0
pull/1049/head
Angus Gratton 2017-09-27 09:49:04 +10:00 zatwierdzone przez Angus Gratton
rodzic 01aad8f386
commit c9241b4310
1 zmienionych plików z 1 dodań i 1 usunięć

Wyświetl plik

@ -222,7 +222,7 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
}
BE_STREAM_TO_UINT16 (cont_offset, p_req);
if (cont_offset != p_ccb->cont_offset) {
if (cont_offset != p_ccb->cont_offset || num_rsp_handles < cont_offset) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE,
SDP_TEXT_BAD_CONT_INX);
return;