From 73bce2208627042bbc698715d00e99f0501f3258 Mon Sep 17 00:00:00 2001 From: Aravind Machiry Date: Sun, 27 Sep 2020 23:44:46 -0700 Subject: lib/sdp.c: Validate attribute search return value The calls to gen_[searchseq|attridseq]_seq functions return negative value on failure. The return value should be checked to gracefully exit with a proper exit code. --- lib/sdp.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'lib') diff --git a/lib/sdp.c b/lib/sdp.c index 532039a23..a27cd3a7b 100644 --- a/lib/sdp.c +++ b/lib/sdp.c @@ -3419,6 +3419,12 @@ int sdp_service_search_req(sdp_session_t *session, const sdp_list_t *search, /* add service class IDs for search */ seqlen = gen_searchseq_pdu(pdata, search); + if (seqlen < 0) { + errno = EINVAL; + status = -1; + goto end; + } + SDPDBG("Data seq added : %d", seqlen); /* set the length and increment the pointer */ @@ -3841,6 +3847,11 @@ int sdp_service_search_async(sdp_session_t *session, const sdp_list_t *search, u /* add service class IDs for search */ seqlen = gen_searchseq_pdu(pdata, search); + if (seqlen < 0) { + t->err = EINVAL; + goto end; + } + SDPDBG("Data seq added : %d", seqlen); /* now set the length and increment the pointer */ @@ -4054,6 +4065,11 @@ int sdp_service_search_attr_async(sdp_session_t *session, const sdp_list_t *sear /* add service class IDs for search */ seqlen = gen_searchseq_pdu(pdata, search); + if (seqlen < 0) { + t->err = EINVAL; + goto end; + } + SDPDBG("Data seq added : %d", seqlen); /* now set the length and increment the pointer */ -- cgit v1.2.1