fix(bt/bluedroid): disconnect SDP connection on receiving incorrect response

BetterJincheng · BetterJincheng · commit f22b03cd7e9a · 2024-11-25T10:19:05.000+08:00
diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c b/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c
@@ -453,7 +453,7 @@ static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
         }
     }
 
-    /* Now, ask for the next handle. Re-use the buffer we just got. */
+    /* Now, ask for the next handle. Reuse the buffer we just got. */
     if (p_ccb->cur_handle < p_ccb->num_handles) {
         BT_HDR  *p_msg = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE);
         UINT8   *p;
@@ -669,6 +669,7 @@ static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
 
     if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) {
         SDP_TRACE_WARNING ("SDP - Wrong type: 0x%02x in attr_rsp\n", type);
+        sdp_disconnect (p_ccb, SDP_ILLEGAL_PARAMETER);
         return;
     }
     p = sdpu_get_len_from_type (p, type, &seq_len);

Original file line number	Diff line number	Diff line change
`@@ -453,7 +453,7 @@ static void process_service_attr_rsp (tCONN_CB p_ccb, UINT8 p_reply)`
`453`	`453`	`}`
`454`	`454`	`}`
`455`	`455`
`456`		`- /* Now, ask for the next handle. Re-use the buffer we just got. */`
	`456`	`+ /* Now, ask for the next handle. Reuse the buffer we just got. */`
`457`	`457`	`if (p_ccb->cur_handle < p_ccb->num_handles) {`
`458`	`458`	`BT_HDR p_msg = (BT_HDR ) osi_malloc(SDP_DATA_BUF_SIZE);`
`459`	`459`	`UINT8 *p;`
`@@ -669,6 +669,7 @@ static void process_service_search_attr_rsp (tCONN_CB p_ccb, UINT8 p_reply)`
`669`	`669`
`670`	`670`	`if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) {`
`671`	`671`	`SDP_TRACE_WARNING ("SDP - Wrong type: 0x%02x in attr_rsp\n", type);`
	`672`	`+ sdp_disconnect (p_ccb, SDP_ILLEGAL_PARAMETER);`
`672`	`673`	`return;`
`673`	`674`	`}`
`674`	`675`	`p = sdpu_get_len_from_type (p, type, &seq_len);`