[automerger] Fix copy length calculation in sdp_copy_raw_data am: 1a0571a4ac am:...

Change-Id: I37cb9240f3e471768d454e41a37143f16bd4f4e7

diff --git a/stack/sdp/sdp_discovery.c b/stack/sdp/sdp_discovery.c
index f0728ec..9462a27 100644 (file)
--- a/stack/sdp/sdp_discovery.c
+++ b/stack/sdp/sdp_discovery.c
@@ -377,8 +377,15 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
 
         if(offset)
         {
+            cpy_len -= 1;
             type = *p++;
+            uint8_t* old_p = p;
             p = sdpu_get_len_from_type (p, type, &list_len);
+            if ((int)cpy_len < (p - old_p)) {
+                SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
+                return;
+            }
+            cpy_len -= (p - old_p);
         }
         if(list_len < cpy_len )
         {