pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bt): enhanced packet length check in sdp_server.c

Browse Source
This commit is contained in:
Jin Cheng
2025-12-22 17:33:45 +08:00
committed by Jin Cheng
parent 458150888d
commit 46baa2dac1
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/sdp/sdp_server.c
+13 -6
View File
@@ -118,6 +118,10 @@ void sdp_server_handle_client_req (tCONN_CB *p_ccb, BT_HDR *p_msg)
UINT8 pdu_id;
UINT16 trans_num, param_len;
if (p_msg->len < 5) {
SDP_TRACE_WARNING("SDP - short request received: len=%u\n", p_msg->len);
return;
}
/* Start inactivity timer */
btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT);
@@ -187,6 +191,11 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
return;
}
if (p_req + 2 > p_req_end) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_MAX_RECORDS_LIST);
return;
}
/* Get the max replies we can send. Cap it at our max anyways. */
BE_STREAM_TO_UINT16 (max_replies, p_req);
@@ -194,7 +203,6 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
max_replies = SDP_MAX_RECORDS;
}
if ((!p_req) || (p_req > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_MAX_RECORDS_LIST);
return;
@@ -322,14 +330,13 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
BOOLEAN is_cont = FALSE;
UINT16 attr_len;
/* Extract the record handle */
BE_STREAM_TO_UINT32 (rec_handle, p_req);
if (p_req > p_req_end) {
if (p_req + 4 + 2 > p_req_end) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_SERV_REC_HDL, SDP_TEXT_BAD_HANDLE);
return;
}
/* Extract the record handle */
BE_STREAM_TO_UINT32 (rec_handle, p_req);
/* Get the max list length we can send. Cap it at MTU size minus overhead */
BE_STREAM_TO_UINT16 (max_list_len, p_req);
@@ -371,7 +378,7 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
return;
}
if (*p_req++ != SDP_CONTINUATION_LEN) {
if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN);
return;
}