SDP parameter checks too loose
SDP Server's client req handler currently only check that the parameter length field does not indicate the parameters to excite the packet length. Sending SDP PDUs with
- fixed sdp_server_client_req to also check for length filed
If an invalid SDP Service Search Request Packet has the continuation info length field set to SDP_CONTINUATION_LEN, but does not contain any continuation information, the SDP server should answer with SDP_INVALID_CONT_STATE.
- fixed process_service_search so the length field is correctly checked
- fixed possible access to 2 bytes of memory outside the packet boundry
Bug: 10904535
Change-Id: I41fd021327fbf4f810ee4319bc95fa0dba0b48df
1 file changed