korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2024-12-16 23:45:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

sdp: Upgrade datatype SEQ8 to SEQ16 when data size is greater than 256

Browse Source 
Fixes a bug where the complete sequence data is written, but the size
is truncated to one byte.
This commit is contained in:
Bart Westgeest 2012-11-19 14:04:32 -05:00 committed by Johan Hedberg
parent 06c25421af
commit f8b977a776
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/sdp.c
View File

@ -786,23 +786,29 @@ static int sdp_gen_buffer(sdp_buf_t *buf, sdp_data_t *d)
int sdp_gen_pdu(sdp_buf_t *buf, sdp_data_t *d)
{
uint32_t pdu_size = 0, data_size = 0;
uint32_t pdu_size, data_size;
unsigned char *src = NULL, is_seq = 0, is_alt = 0;
uint8_t dtd = d->dtd;
uint16_t u16;
uint32_t u32;
uint64_t u64;
uint128_t u128;
uint8_t *seqp = buf->data + buf->data_size;
uint32_t orig_data_size = buf->data_size;
pdu_size = sdp_get_data_type_size(dtd);
recalculate:
pdu_size = sdp_get_data_type_size(d->dtd);
buf->data_size += pdu_size;
data_size = sdp_get_data_size(buf, d);
if (data_size > UCHAR_MAX && d->dtd == SDP_SEQ8) {
buf->data_size = orig_data_size;
d->dtd = SDP_SEQ16;
goto recalculate;
}
*seqp = dtd;
*seqp = d->dtd;
switch (dtd) {
switch (d->dtd) {
case SDP_DATA_NIL:
break;
case SDP_UINT8:
@ -884,7 +890,7 @@ int sdp_gen_pdu(sdp_buf_t *buf, sdp_data_t *d)
if (src && buf->buf_size >= buf->data_size + data_size) {
memcpy(buf->data + buf->data_size, src, data_size);
buf->data_size += data_size;
} else if (dtd != SDP_DATA_NIL) {
} else if (d->dtd != SDP_DATA_NIL) {
SDPDBG("Gen PDU : Can't copy from invalid source or dest\n");
}
}