d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add extra sanity check for SDP packets in libsdp(3)

Browse Source 
Fix yet another endianess bug in sdpd(8)
This commit is contained in:
Maksim Yevmenkin 2004-02-26 20:44:55 +00:00
parent f97e834b02
commit 0d60ad30ca
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/libsdp/search.c
View File

@ -167,6 +167,7 @@ sdp_search(void *xss,
if (xpdu.pdu.pid == SDP_PDU_ERROR_RESPONSE ||
xpdu.pdu.tid != ss->tid ||
xpdu.pdu.len > len ||
xpdu.len > xpdu.pdu.len) {
ss->error = EIO;
return (-1);

4
usr.sbin/bluetooth/sdpd/sar.c
View File

@ -277,7 +277,7 @@ server_send_service_attribute_response(server_p srv, int32_t fd)
assert(rsp_end >= rsp);
bcount = htons(rsp_end - rsp);
bcount = rsp_end - rsp;
if (((sdp_pdu_p)(srv->req))->pid == SDP_PDU_SERVICE_ATTRIBUTE_REQUEST)
pdu.pid = SDP_PDU_SERVICE_ATTRIBUTE_RESPONSE;
@ -287,6 +287,8 @@ server_send_service_attribute_response(server_p srv, int32_t fd)
pdu.tid = ((sdp_pdu_p)(srv->req))->tid;
pdu.len = htons(sizeof(bcount) + bcount + 1 + cs[0]);
bcount = htons(bcount);
iov[0].iov_base = &pdu;
iov[0].iov_len = sizeof(pdu);