diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2017-09-13 10:01:40 +0300 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2017-09-13 09:05:51 +0200 |
| commit | 9e009647b14e810e06626dde7f1bb9ea3c375d09 (patch) | |
| tree | 553338fbbebba8a6f13893974421664fca7ef199 | |
| parent | 660081ce5a6217c51ad0fb8e3801a17c34d1f320 (diff) | |
sdp: Fix Out-of-bounds heap read in service_search_attr_req function
Check if there is enough data to continue otherwise return an error.
| -rw-r--r-- | src/sdpd-request.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/sdpd-request.c b/src/sdpd-request.c index 1eefdce1ac..318d044673 100644 --- a/src/sdpd-request.c +++ b/src/sdpd-request.c @@ -917,7 +917,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf) } else { /* continuation State exists -> get from cache */ sdp_buf_t *pCache = sdp_get_cached_rsp(cstate); - if (pCache) { + if (pCache && cstate->cStateValue.maxBytesSent < pCache->data_size) { uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent); pResponse = pCache->data; memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent); |