Skip to content

Commit bf695d0

Browse files
wmy-espressifwmy-espressif
committed
Merge branch 'bugfix/possible_buffer_overflow' into 'master'
Bugfix/possible buffer overflow Closes BT-4111 See merge request espressif/esp-idf!41878
2 parents 25c40d4 + 075ed21 commit bf695d0

File tree

14 files changed

+279
-68
lines changed

14 files changed

+279
-68
lines changed

‎components/bt/host/bluedroid/bta/av/bta_av_act.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -685,11 +685,18 @@ static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
685685
{
686686
tAVRC_STS status = BTA_AV_STS_NO_RSP;
687687
UINT16 u16;
688-
UINT8 *p = p_vendor->p_vendor_data + 2;
688+
UINT8 *p = NULL;
689+
690+
if (!p_vendor || !p_vendor->p_vendor_data ||
691+
(p_vendor->vendor_len != AVRC_REGISTER_NOTIFICATION_CMD_SIZE)) {
692+
return AVRC_STS_INTERNAL_ERR;
693+
}
694+
695+
p = p_vendor->p_vendor_data + AVRC_CMD_PARAM_LENGTH_OFFSET;
689696

690697
BE_STREAM_TO_UINT16 (u16, p);
691698
/* double check the fixed length */
692-
if ((u16 != 5) || (p_vendor->vendor_len != 9)) {
699+
if (u16 != 5) {
693700
status = AVRC_STS_INTERNAL_ERR;
694701
} else {
695702
/* make sure the event_id is valid */
@@ -722,6 +729,12 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE *p_rc_rsp, tBTA_AV_RC_MSG *p_ms
722729

723730
#if (AVRC_METADATA_INCLUDED == TRUE)
724731

732+
if (!p_vendor || !p_vendor->p_vendor_data || (p_vendor->vendor_len == 0)) {
733+
evt = 0;
734+
p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
735+
return evt;
736+
}
737+
725738
pdu = *(p_vendor->p_vendor_data);
726739
p_rc_rsp->pdu = pdu;
727740
*p_ctype = AVRC_RSP_REJ;
@@ -741,12 +754,16 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE *p_rc_rsp, tBTA_AV_RC_MSG *p_ms
741754
switch (pdu) {
742755
case AVRC_PDU_GET_CAPABILITIES:
743756
/* process GetCapabilities command without reporting the event to app */
757+
if (p_vendor->vendor_len != AVRC_GET_CAPABILITIES_CMD_SIZE) {
758+
p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
759+
break;
760+
}
744761
evt = 0;
745-
u8 = *(p_vendor->p_vendor_data + 4);
746-
p = p_vendor->p_vendor_data + 2;
762+
u8 = *(p_vendor->p_vendor_data + AVRC_CMD_PARAM_VALUE_OFFSET);
763+
p = p_vendor->p_vendor_data + AVRC_CMD_PARAM_LENGTH_OFFSET;
747764
p_rc_rsp->get_caps.capability_id = u8;
748765
BE_STREAM_TO_UINT16 (u16, p);
749-
if ((u16 != 1) || (p_vendor->vendor_len != 5)) {
766+
if (u16 != 1) {
750767
p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
751768
} else {
752769
p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;

‎components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c‎

Lines changed: 50 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -582,22 +582,35 @@ static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
582582

583583
static void handle_rc_attributes_rsp (tAVRC_MSG_VENDOR *vendor_msg)
584584
{
585-
uint8_t attr_count = vendor_msg->p_vendor_data[4];
585+
uint8_t attr_count = 0;
586586
int attr_index = 5;
587587
int attr_length = 0;
588588
uint32_t attr_id = 0;
589589

590+
if (!vendor_msg || !vendor_msg->p_vendor_data ||
591+
(vendor_msg->vendor_len < AVRC_GET_ELEMENT_ATTR_RSP_SIZE_MIN)) {
592+
return;
593+
}
594+
590595
//Check if there are any attributes
591-
if (attr_count < 1) {
596+
if ((attr_count = vendor_msg->p_vendor_data[AVRC_RSP_PARAM_VALUE_OFFSET]) < 1) {
592597
return;
593598
}
594599

595600
esp_avrc_ct_cb_param_t param[attr_count];
596601
memset(&param[0], 0, sizeof(esp_avrc_ct_cb_param_t) * attr_count);
597602

598603
for (int i = 0; i < attr_count; i++) {
604+
if (vendor_msg->vendor_len < attr_index + 8) {
605+
return;
606+
}
607+
599608
attr_length = (int) vendor_msg->p_vendor_data[7 + attr_index] | vendor_msg->p_vendor_data[6 + attr_index] << 8;
600609

610+
if (vendor_msg->vendor_len < attr_index + attr_length + 8) {
611+
return;
612+
}
613+
601614
//Received attribute text is not null terminated, so it's useful to know it's length
602615
param[i].meta_rsp.attr_length = attr_length;
603616
param[i].meta_rsp.attr_text = &vendor_msg->p_vendor_data[8 + attr_index];
@@ -620,30 +633,52 @@ static void handle_rc_notification_rsp (tAVRC_MSG_VENDOR *vendor_msg)
620633
esp_avrc_ct_cb_param_t param;
621634
memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
622635

623-
param.change_ntf.event_id = vendor_msg->p_vendor_data[4];
636+
if (!vendor_msg || !vendor_msg->p_vendor_data ||
637+
(vendor_msg->vendor_len < AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN)) {
638+
return;
639+
}
640+
641+
param.change_ntf.event_id = vendor_msg->p_vendor_data[AVRC_RSP_PARAM_VALUE_OFFSET];
624642

625-
uint8_t *data = &vendor_msg->p_vendor_data[5];
643+
uint8_t *data = &vendor_msg->p_vendor_data[AVRC_RSP_PARAM_VALUE_OFFSET + 1];
626644
if (!btc_avrc_ct_rn_evt_supported(param.change_ntf.event_id)) {
627645
BTC_TRACE_WARNING("%s unsupported notification on CT, event id 0x%x", __FUNCTION__,
628646
param.change_ntf.event_id);
629647
return;
630648
}
631649

650+
651+
bool notif = false;
632652
switch (param.change_ntf.event_id) {
633653
case ESP_AVRC_RN_PLAY_STATUS_CHANGE:
634-
BE_STREAM_TO_UINT8(param.change_ntf.event_parameter.playback, data);
654+
if (vendor_msg->vendor_len >= AVRC_RN_PLAY_STATUS_CHANGE_EVT_SIZE) {
655+
BE_STREAM_TO_UINT8(param.change_ntf.event_parameter.playback, data);
656+
notif = true;
657+
}
635658
break;
636659
case ESP_AVRC_RN_TRACK_CHANGE:
637-
memcpy(param.change_ntf.event_parameter.elm_id, data, 8);
660+
if (vendor_msg->vendor_len >= AVRC_RN_TRACK_CHANGE_EVT_SIZE) {
661+
memcpy(param.change_ntf.event_parameter.elm_id, data, 8);
662+
notif = true;
663+
}
638664
break;
639665
case ESP_AVRC_RN_PLAY_POS_CHANGED:
640-
BE_STREAM_TO_UINT32(param.change_ntf.event_parameter.play_pos, data);
666+
if (vendor_msg->vendor_len >= AVRC_RN_PLAY_POS_CHANGED_EVT_SIZE) {
667+
BE_STREAM_TO_UINT32(param.change_ntf.event_parameter.play_pos, data);
668+
notif = true;
669+
}
641670
break;
642671
case ESP_AVRC_RN_BATTERY_STATUS_CHANGE:
643-
BE_STREAM_TO_UINT8(param.change_ntf.event_parameter.batt, data);
672+
if (vendor_msg->vendor_len >= AVRC_RN_BATTERY_STATUS_CHANGE_EVT_SIZE) {
673+
BE_STREAM_TO_UINT8(param.change_ntf.event_parameter.batt, data);
674+
notif = true;
675+
}
644676
break;
645677
case ESP_AVRC_RN_VOLUME_CHANGE:
646-
BE_STREAM_TO_UINT8(param.change_ntf.event_parameter.volume, data);
678+
if (vendor_msg->vendor_len >= AVRC_RN_VOLUME_CHANGE_EVT_SIZE) {
679+
BE_STREAM_TO_UINT8(param.change_ntf.event_parameter.volume, data);
680+
notif = true;
681+
}
647682
break;
648683
// for non-parameter event response
649684
case ESP_AVRC_RN_TRACK_REACHED_END:
@@ -661,7 +696,10 @@ static void handle_rc_notification_rsp (tAVRC_MSG_VENDOR *vendor_msg)
661696
param.change_ntf.event_id);
662697
break;
663698
}
664-
btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CHANGE_NOTIFY_EVT, &param);
699+
700+
if (notif) {
701+
btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CHANGE_NOTIFY_EVT, &param);
702+
}
665703
}
666704

667705
static void handle_rc_get_caps_rsp (tAVRC_GET_CAPS_RSP *rsp)
@@ -852,7 +890,7 @@ static void handle_rc_metamsg_rsp (tBTA_AV_META_MSG *p_meta_msg)
852890
tAVRC_RESPONSE avrc_response = {0};
853891
tAVRC_STS status;
854892
tAVRC_MSG_VENDOR *vendor_msg = &p_meta_msg->p_msg->vendor;
855-
BTC_TRACE_DEBUG("%s: opcode %d, pdu 0x%x, code %d", __FUNCTION__, p_meta_msg->p_msg->hdr.opcode, vendor_msg->p_vendor_data[0],
893+
BTC_TRACE_DEBUG("%s: opcode %d, pdu 0x%x, code %d", __FUNCTION__, p_meta_msg->p_msg->hdr.opcode, vendor_msg->p_vendor_data[AVRC_RSP_OPCODE_OFFSET],
856894
p_meta_msg->code);
857895
if ( p_meta_msg->p_msg->hdr.opcode != AVRC_OP_VENDOR) {
858896
return;
@@ -868,7 +906,7 @@ static void handle_rc_metamsg_rsp (tBTA_AV_META_MSG *p_meta_msg)
868906

869907
// handle GET_ELEMENT_ATTR response
870908
if (p_meta_msg->code == AVRC_RSP_IMPL_STBL &&
871-
vendor_msg->p_vendor_data[0] == AVRC_PDU_GET_ELEMENT_ATTR) {
909+
vendor_msg->p_vendor_data[AVRC_RSP_OPCODE_OFFSET] == AVRC_PDU_GET_ELEMENT_ATTR) {
872910
handle_rc_attributes_rsp(vendor_msg);
873911
return;
874912
}

‎components/bt/host/bluedroid/stack/avrc/avrc_api.c‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -545,7 +545,22 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr,
545545

546546
p_data = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
547547
memset(&msg, 0, sizeof(tAVRC_MSG) );
548-
{
548+
549+
if (p_pkt->layer_specific == AVCT_DATA_BROWSE) {
550+
// opcode = AVRC_OP_BROWSE;
551+
// msg.browse.hdr.ctype = cr;
552+
// msg.browse.p_browse_data = p_data;
553+
// msg.browse.browse_len = p_pkt->len;
554+
// msg.browse.p_browse_pkt = p_pkt;
555+
AVRC_TRACE_ERROR("BROWSE CHANNEL NOT SUPPORTED NOW!");
556+
osi_free(p_pkt);
557+
return;
558+
} else {
559+
if (p_pkt->len < AVRC_AVC_HDR_SIZE) {
560+
AVRC_TRACE_WARNING("Bad message length:%d (< %d)", p_pkt->len, AVRC_AVC_HDR_SIZE);
561+
osi_free(p_pkt);
562+
return;
563+
}
549564
msg.hdr.ctype = p_data[0] & AVRC_CTYPE_MASK;
550565
AVRC_TRACE_DEBUG("avrc_msg_cback handle:%d, ctype:%d, offset:%d, len: %d",
551566
handle, msg.hdr.ctype, p_pkt->offset, p_pkt->len);
@@ -578,6 +593,14 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr,
578593
p_drop_msg = "auto respond";
579594
#endif
580595
} else {
596+
if (p_pkt->len < AVRC_OP_UNIT_INFO_RSP_LEN) {
597+
AVRC_TRACE_WARNING("Bad message length:%d (< %d)", p_pkt->len, AVRC_OP_UNIT_INFO_RSP_LEN);
598+
drop = TRUE;
599+
#if (BT_USE_TRACES == TRUE)
600+
p_drop_msg = "UNIT_INFO_RSP too short";
601+
#endif
602+
break;
603+
}
581604
/* parse response */
582605
p_data += 4; /* 3 bytes: ctype, subunit*, opcode + octet 3 (is 7)*/
583606
msg.unit.unit_type = (*p_data & AVRC_SUBTYPE_MASK) >> AVRC_SUBTYPE_SHIFT;
@@ -594,7 +617,7 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr,
594617
p_rsp_data = avrc_get_data_ptr(p_rsp);
595618
*p_rsp_data = AVRC_RSP_IMPL_STBL;
596619
/* check & set the offset. set response code, set (subunit_type & subunit_id),
597-
set AVRC_OP_SUB_INFO, set (page & extention code) */
620+
set AVRC_OP_SUB_INFO, set (page & extension code) */
598621
p_rsp_data += 4;
599622
/* Panel subunit & id=0 */
600623
*p_rsp_data++ = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT);
@@ -606,6 +629,14 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr,
606629
p_drop_msg = "auto responded";
607630
#endif
608631
} else {
632+
if (p_pkt->len < AVRC_OP_SUB_UNIT_INFO_RSP_LEN) {
633+
AVRC_TRACE_WARNING("Bad message length:%d (< %d)", p_pkt->len, AVRC_OP_SUB_UNIT_INFO_RSP_LEN);
634+
drop = TRUE;
635+
#if (BT_USE_TRACES == TRUE)
636+
p_drop_msg = "UNIT_INFO_RSP too short";
637+
#endif
638+
break;
639+
}
609640
/* parse response */
610641
p_data += AVRC_AVC_HDR_SIZE; /* 3 bytes: ctype, subunit*, opcode */
611642
msg.sub.page = (*p_data++ >> AVRC_SUB_PAGE_SHIFT) & AVRC_SUB_PAGE_MASK;

‎components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
5656
if (p_msg->vendor_len == 0) {
5757
return AVRC_STS_NO_ERROR;
5858
}
59-
if (p_msg->p_vendor_data == NULL) {
59+
if ((p_msg->p_vendor_data == NULL) || (p_msg->vendor_len < AVRC_CMD_FIXED_SIZE)) {
6060
return AVRC_STS_INTERNAL_ERR;
6161
}
6262

‎components/bt/host/bluedroid/stack/include/stack/avrc_defs.h‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,55 @@
214214
#define AVRC_PDU_ADD_TO_NOW_PLAYING 0x90
215215
#define AVRC_PDU_GENERAL_REJECT 0xA0
216216

217+
/* Define the length of vendor dependent PDUs
218+
*/
219+
#define AVRC_CMD_PARAM_LENGTH_OFFSET 2
220+
#define AVRC_CMD_PARAM_VALUE_OFFSET 4
221+
#define AVRC_CMD_FIXED_SIZE 4
222+
223+
#define AVRC_GET_CAPABILITIES_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 1)
224+
#define AVRC_LIST_PLAYER_APP_ATTR_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 0)
225+
#define AVRC_LIST_PLAYER_APP_VALUES_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 1)
226+
#define AVRC_GET_CUR_PLAYER_APP_VALUE_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 2)
227+
#define AVRC_SET_PLAYER_APP_VALUE_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 3)
228+
#define AVRC_GET_PLAYER_APP_ATTR_TEXT_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 2)
229+
#define AVRC_GET_PLAYER_APP_VALUE_TEXT_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 3)
230+
#define AVRC_INFORM_DISPLAY_CHARSET_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 3)
231+
#define AVRC_INFORM_BATTERY_STAT_OF_CT_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 1)
232+
#define AVRC_GET_ELEMENT_ATTR_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 13)
233+
#define AVRC_GET_PLAY_STATUS_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 0)
234+
#define AVRC_REGISTER_NOTIFICATION_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 5)
235+
#define AVRC_REQUEST_CONTINUATION_RSP_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 1)
236+
#define AVRC_ABORT_CONTINUATION_RSP_CMD_SIZE (AVRC_CMD_FIXED_SIZE + 1)
237+
238+
/* Define the length of response of vendor dependent PDUs
239+
*/
240+
#define AVRC_RSP_OPCODE_OFFSET 0
241+
#define AVRC_RSP_PARAM_LENGTH_OFFSET 2
242+
#define AVRC_RSP_PARAM_VALUE_OFFSET 4
243+
#define AVRC_RSP_FIXED_SIZE 4
244+
245+
#define AVRC_GET_CAPABILITIES_RSP_SIZE_MIN (AVRC_RSP_FIXED_SIZE + 1)
246+
#define AVRC_LIST_PLAYER_APP_ATTR_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 2)
247+
#define AVRC_LIST_PLAYER_APP_VALUES_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 2)
248+
#define AVRC_GET_CUR_PLAYER_APP_VALUE_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 3)
249+
#define AVRC_SET_PLAYER_APP_VALUE_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 2)
250+
#define AVRC_GET_PLAYER_APP_ATTR_TEXT_RSP_SIZE_MIN (AVRC_RSP_FIXED_SIZE + 6)
251+
#define AVRC_GET_PLAYER_APP_VALUE_TEXT_RSP_SIZE_MIN (AVRC_RSP_FIXED_SIZE + 6)
252+
#define AVRC_INFORM_DISPLAY_CHARSET_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 0)
253+
#define AVRC_INFORM_BATTERY_STAT_OF_CT_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 0)
254+
#define AVRC_GET_ELEMENT_ATTR_RSP_SIZE_MIN (AVRC_RSP_FIXED_SIZE + 1)
255+
#define AVRC_GET_PLAY_STATUS_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 9)
256+
#define AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN (AVRC_RSP_FIXED_SIZE + 2)
257+
#define AVRC_RN_PLAY_STATUS_CHANGE_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN)
258+
#define AVRC_RN_TRACK_CHANGE_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN + 7)
259+
#define AVRC_RN_PLAY_POS_CHANGED_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN + 3)
260+
#define AVRC_RN_BATTERY_STATUS_CHANGE_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN)
261+
#define AVRC_RN_SYSTEM_STATUS_CHANGE_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN)
262+
#define AVRC_RN_APP_SETTING_CHANGE_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN + 2)
263+
#define AVRC_RN_VOLUME_CHANGE_EVT_SIZE (AVRC_REGISTER_NOTIFICATION_RSP_SIZE_MIN)
264+
#define AVRC_ABORT_CONTINUATION_RSP_RSP_SIZE (AVRC_RSP_FIXED_SIZE + 0)
265+
217266
/* Define the vendor unique id carried in the pass through data
218267
*/
219268
#define AVRC_PDU_NEXT_GROUP 0x00

‎components/bt/host/bluedroid/stack/include/stack/rfcdefs.h‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
#define RFCOMM_UIH 0xEF
4343

4444
/*
45-
** Defenitions for the TS control frames
45+
** Definitions for the TS control frames
4646
*/
4747
#define RFCOMM_CTRL_FRAME_LEN 3
4848
#define RFCOMM_MIN_OFFSET 5 /* ctrl 2 , len 1 or 2 bytes, credit 1 byte */
@@ -90,13 +90,6 @@
9090
pf = (*p_data++ & RFCOMM_PF_MASK) >> RFCOMM_PF_OFFSET;\
9191
}
9292

93-
#define RFCOMM_PARSE_LEN_FIELD(ea, length, p_data) \
94-
{ \
95-
ea = (*p_data & RFCOMM_EA); \
96-
length = (*p_data++ >> RFCOMM_SHIFT_LENGTH1); \
97-
if (!ea) length += (*p_data++ << RFCOMM_SHIFT_LENGTH2); \
98-
}
99-
10093
#define RFCOMM_FRAME_IS_CMD(initiator, cr) \
10194
(( (initiator) && !(cr)) || (!(initiator) && (cr)))
10295

@@ -139,7 +132,7 @@
139132
#define RFCOMM_MSC_FC 0x02 /* Flow control*/
140133
#define RFCOMM_MSC_RTC 0x04 /* Ready to communicate*/
141134
#define RFCOMM_MSC_RTR 0x08 /* Ready to receive*/
142-
#define RFCOMM_MSC_IC 0x40 /* Incomming call indicator*/
135+
#define RFCOMM_MSC_IC 0x40 /* Incoming call indicator*/
143136
#define RFCOMM_MSC_DV 0x80 /* Data Valid*/
144137

145138
#define RFCOMM_MSC_SHIFT_BREAK 4

‎components/bt/host/bluedroid/stack/include/stack/sdp_api.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,8 @@ typedef struct {
9696
UINT8 u8; /* 8-bit integer */
9797
UINT16 u16; /* 16-bit integer */
9898
UINT32 u32; /* 32-bit integer */
99-
UINT8 array[4]; /* Variable length field */
10099
struct t_sdp_disc_attr *p_sub_attr; /* Addr of first sub-attr (list)*/
100+
UINT8 array[]; /* Variable length field */
101101
} v;
102102

103103
} tSDP_DISC_ATVAL;

0 commit comments

Comments
 (0)