From 6cd2e8bf6e5707e8e77e7aca6519c58200ee58db Mon Sep 17 00:00:00 2001 From: Jakub Pawlowski Date: Tue, 29 May 2018 16:17:32 -0700 Subject: [PATCH] Decrease length after reading from array in process_service_attr_req Test: compilation Bug: 78136677 Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0 --- stack/sdp/sdp_server.cc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/stack/sdp/sdp_server.cc b/stack/sdp/sdp_server.cc index f0d882348..9e7a07245 100644 --- a/stack/sdp/sdp_server.cc +++ b/stack/sdp/sdp_server.cc @@ -335,9 +335,11 @@ static void process_service_attr_req(tCONN_CB* p_ccb, uint16_t trans_num, /* Extract the record handle */ BE_STREAM_TO_UINT32(rec_handle, p_req); + param_len -= sizeof(rec_handle); /* Get the max list length we can send. Cap it at MTU size minus overhead */ BE_STREAM_TO_UINT16(max_list_len, p_req); + param_len -= sizeof(max_list_len); if (max_list_len > (p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN)) max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN; -- 2.11.0