Diff between 9e2d91bc75ce093f3a8ff40288c3da0f19fae38d and fcb9ece0f9ef5b141634be945690757c425aa45a

Changed Files

File Additions Deletions Status
lib/sdp.c +24 -2 modified

Full Patch

diff --git a/lib/sdp.c b/lib/sdp.c
index 3c45ac8..9c1eeb5 100644
--- a/lib/sdp.c
+++ b/lib/sdp.c
@@ -1874,19 +1874,41 @@ static int sdp_get_proto_descs(uint16_t attr_id, const sdp_record_t *rec,
 
 	SDPDBG("Attribute value type: 0x%02x\n", pdlist->dtd);
 
-	if (attr_id == SDP_ATTR_ADD_PROTO_DESC_LIST)
+	if (attr_id == SDP_ATTR_ADD_PROTO_DESC_LIST) {
+		if (!SDP_IS_SEQ(pdlist->dtd)) {
+			errno = EINVAL;
+			return -1;
+		}
 		pdlist = pdlist->val.dataseq;
+	}
 
 	for (; pdlist; pdlist = pdlist->next) {
 		sdp_list_t *pds = NULL;
-		for (curr = pdlist->val.dataseq; curr; curr = curr->next)
+
+		if (!SDP_IS_SEQ(pdlist->dtd) && !SDP_IS_ALT(pdlist->dtd))
+			goto failed;
+
+		for (curr = pdlist->val.dataseq; curr; curr = curr->next) {
+			if (!SDP_IS_SEQ(curr->dtd)) {
+				sdp_list_free(pds, NULL);
+				goto failed;
+			}
 			pds = sdp_list_append(pds, curr->val.dataseq);
+		}
+
 		ap = sdp_list_append(ap, pds);
 	}
 
 	*pap = ap;
 
 	return 0;
+
+failed:
+	sdp_list_foreach(ap, (sdp_list_func_t) sdp_list_free, NULL);
+	sdp_list_free(ap, NULL);
+	errno = EINVAL;
+
+	return -1;
 }
 
 int sdp_get_access_protos(const sdp_record_t *rec, sdp_list_t **pap)