Skip to content

Commit bc23851

Browse files
committed
fix(bt): Fixed SDP record integrity check bug
1 parent 67bbe37 commit bc23851

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

components/bt/host/bluedroid/api/esp_sdp_api.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -21,6 +21,10 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
2121
bool ret = true;
2222

2323
if (record != NULL) {
24+
if (record->hdr.type < ESP_SDP_TYPE_RAW || record->hdr.type > ESP_SDP_TYPE_DIP_SERVER) {
25+
LOG_ERROR("Invalid type!\n");
26+
return false;
27+
}
2428
switch (record->hdr.type) {
2529
case ESP_SDP_TYPE_DIP_SERVER:
2630
if (record->dip.vendor_id_source != ESP_SDP_VENDOR_ID_SRC_BT &&
@@ -43,12 +47,14 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
4347
break;
4448

4549
default:
50+
break;
51+
}
52+
if (record->hdr.type != ESP_SDP_TYPE_DIP_SERVER) {
4653
if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
4754
strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
4855
LOG_ERROR("Invalid server name!\n");
4956
ret = false;
5057
}
51-
break;
5258
}
5359
} else {
5460
LOG_ERROR("record is NULL!\n");

0 commit comments

Comments
 (0)