sdp: Fix buffer overflow

sdp_append_buf shall check if there is enough space to store the data
before copying it.

An independent security researcher, Julian Rauchberger, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.

Change-Id: I15d089ecda58b507776767f595c3006cd3f8b90c
Signed-off-by: himanshu <h.himanshu@samsung.com>

diff --git a/lib/sdp.c b/lib/sdp.c
index eb408a9..84311ed 100755 (executable)
--- a/lib/sdp.c
+++ b/lib/sdp.c
@@ -2834,6 +2834,12 @@ void sdp_append_to_buf(sdp_buf_t *dst, uint8_t *data, uint32_t len)
        SDPDBG("Append src size: %d", len);
        SDPDBG("Append dst size: %d", dst->data_size);
        SDPDBG("Dst buffer size: %d", dst->buf_size);
+
+       if (dst->data_size + len > dst->buf_size) {
+               SDPERR("Cannot append");
+               return;
+       }
+
        if (dst->data_size == 0 && dtd == 0) {
                /* create initial sequence */
                *p = SDP_SEQ8;