Skip to content

Commit 49157ea

Browse files
lylezhu2012henrikbrixandersen
authored andcommitted
Bluetooth: SDP: Check tail room of allocated buffer
In partial resolved notification case, there is a case that the tail room of new allocated buffer is not bigger than the tail room of the current receiving buffer. Since, the new allocated buffer has the same size with the current receiving buffer, it means a complete SDP record cannot fit into the allocated buffer. In this way, the following SDP discovery should be stopped. In partial resolved notification case, if the tail room of the new allocated buffer is not more the tail room of the current receiving buffer, reports the error `-ENOMEM` and stop the following SDP discovery. Signed-off-by: Lyle Zhu <[email protected]>
1 parent 6244078 commit 49157ea

File tree

1 file changed

+14
-5
lines changed
  • subsys/bluetooth/host/classic

1 file changed

+14
-5
lines changed

subsys/bluetooth/host/classic/sdp.c

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1932,17 +1932,26 @@ static int sdp_client_notify_result(struct bt_sdp_client *session,
19321932
buf = net_buf_alloc(session->param->pool, K_NO_WAIT);
19331933
if (buf != NULL) {
19341934
if (net_buf_tailroom(buf) < len) {
1935-
LOG_ERR("No more buffer space for SDP discover. "
1936-
"Need to increase buffer size of the "
1937-
"receiving pool.");
1938-
net_buf_unref(buf);
1939-
return -ENOMEM;
1935+
goto no_more_space;
19401936
}
1937+
19411938
net_buf_add_mem(buf, src, len);
1939+
if (net_buf_tailroom(buf) <=
1940+
net_buf_tailroom(session->rec_buf)) {
1941+
goto no_more_space;
1942+
}
1943+
19421944
net_buf_unref(session->rec_buf);
19431945
session->rec_buf = buf;
19441946
LOG_DBG("Continue discovery with new buf %p", buf);
19451947
return 0;
1948+
1949+
no_more_space:
1950+
LOG_ERR("Allocated buffer has not more space for the next "
1951+
"SDP discover. Need to increase date size of the "
1952+
"receiving pool.");
1953+
net_buf_unref(buf);
1954+
return -ENOMEM;
19461955
}
19471956

19481957
net_buf_reset(session->rec_buf);

0 commit comments

Comments
 (0)