system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-21 18:27:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Add extra sanity check for SDP packets in libsdp(3)

Browse source 
Fix yet another endianess bug in sdpd(8)
This commit is contained in:
Maksim Yevmenkin 2004-02-26 20:44:55 +00:00
parent f97e834b02
commit 0d60ad30ca
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=126297
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/libsdp/search.c
View file

@ -167,6 +167,7 @@ sdp_search(void *xss,
if (xpdu.pdu.pid == SDP_PDU_ERROR_RESPONSE ||
xpdu.pdu.tid != ss->tid ||
xpdu.pdu.len > len ||
xpdu.len > xpdu.pdu.len) {
ss->error = EIO;
return (-1);

4
usr.sbin/bluetooth/sdpd/sar.c
View file

@ -277,7 +277,7 @@ server_send_service_attribute_response(server_p srv, int32_t fd)
assert(rsp_end >= rsp);
bcount = htons(rsp_end - rsp);
bcount = rsp_end - rsp;
if (((sdp_pdu_p)(srv->req))->pid == SDP_PDU_SERVICE_ATTRIBUTE_REQUEST)
pdu.pid = SDP_PDU_SERVICE_ATTRIBUTE_RESPONSE;
@ -287,6 +287,8 @@ server_send_service_attribute_response(server_p srv, int32_t fd)
pdu.tid = ((sdp_pdu_p)(srv->req))->tid;
pdu.len = htons(sizeof(bcount) + bcount + 1 + cs[0]);
bcount = htons(bcount);
iov[0].iov_base = &pdu;
iov[0].iov_len = sizeof(pdu);