Merge ~kzapalowicz/snappy-hwe-snaps/+git/bluez:fix/cve-blueborne into ~snappy-hwe-team/snappy-hwe-snaps/+git/bluez:bluez/5.44

[Konrad Zapałowicz]

Fix CVE-2017-1000250

More details: https://www.armis.com/blueborne/, patch based on https://launchpadlibrarian.net/336654263/bluez_5.37-0ubuntu5_5.37-0ubuntu5.1.diff.gz

[Simon Fels (morphis)]

LGTM

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:bcf7b1d88537efed65728fcf9a0429b9949b5800
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1948/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/3431
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1857/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/3688

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1948/rebuild

review: Approve (continuous-integration)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index 1eefdce..ddeea7f 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -918,15 +918,20 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 		/* continuation State exists -> get from cache */
 		sdp_buf_t *pCache = sdp_get_cached_rsp(cstate);
 		if (pCache) {
-			uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
-			pResponse = pCache->data;
-			memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
-			buf->data_size += sent;
-			cstate->cStateValue.maxBytesSent += sent;
-			if (cstate->cStateValue.maxBytesSent == pCache->data_size)
-				cstate_size = sdp_set_cstate_pdu(buf, NULL);
-			else
-				cstate_size = sdp_set_cstate_pdu(buf, cstate);
+			if (cstate->cStateValue.maxBytesSent >= pCache->data_size) {
+				status = SDP_INVALID_CSTATE;
+				SDPDBG("Got bad cstate with invalid size");
+			} else {
+				uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
+				pResponse = pCache->data;
+				memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
+				buf->data_size += sent;
+				cstate->cStateValue.maxBytesSent += sent;
+				if (cstate->cStateValue.maxBytesSent == pCache->data_size)
+					cstate_size = sdp_set_cstate_pdu(buf, NULL);
+				else
+					cstate_size = sdp_set_cstate_pdu(buf, cstate);
+			}
 		} else {
 			status = SDP_INVALID_CSTATE;
 			SDPDBG("Non-null continuation state, but null cache buffer");