X-Git-Url: http://git.osdn.net/view?a=blobdiff_plain;f=stack%2Fsdp%2Fsdp_discovery.c;h=6402b797d6cc17f2ffd93087033b5b519c5be162;hb=1a0571a4aca9d597a8f79665aa220decf0d45ce1;hp=2ca2018700b1a253ff2bcecb38dea115f3ba4246;hpb=9f34d92336b6774de37b3975f60ac7ef4b9850aa;p=android-x86%2Fsystem-bt.git

diff --git a/stack/sdp/sdp_discovery.c b/stack/sdp/sdp_discovery.c
index 2ca201870..6402b797d 100644
--- a/stack/sdp/sdp_discovery.c
+++ b/stack/sdp/sdp_discovery.c
@@ -353,7 +353,7 @@ static void process_service_search_rsp(tCONN_CB *p_ccb, UINT8 *p_reply,
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
 static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
 {
-    unsigned int    cpy_len;
+    unsigned int    cpy_len, rem_len;
     UINT32          list_len;
     UINT8           *p;
     UINT8           type;
@@ -377,13 +377,25 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
 
         if(offset)
         {
+            cpy_len -= 1;
             type = *p++;
+            uint8_t* old_p = p;
             p = sdpu_get_len_from_type (p, type, &list_len);
+            if ((int)cpy_len < (p - old_p)) {
+                SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
+                return;
+            }
+            cpy_len -= (p - old_p);
         }
-        if(list_len && list_len < cpy_len )
+        if(list_len < cpy_len )
         {
             cpy_len = list_len;
         }
+        rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int)(p - &p_ccb->rsp_list[0]);
+        if (cpy_len > rem_len) {
+            SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);
+            cpy_len = rem_len;
+        }
 #if (SDP_DEBUG_RAW == TRUE)
         SDP_TRACE_WARNING("list_len :%d cpy_len:%d raw_size:%d raw_used:%d",
             list_len, cpy_len, p_ccb->p_db->raw_size, p_ccb->p_db->raw_used);