Merge ~kzapalowicz/snappy-hwe-snaps/+git/bluez:feature/fix-blueborne-5.34 into ~snappy-hwe-team/snappy-hwe-snaps/+git/bluez:bluez-5.34

[Konrad Zapałowicz]

Fix Blueborne CVE-2017-1000250

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

LGTM

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

FAILED: Continuous integration, rev:4d8e9daeb31a0299b071e46519790ccad2e2086c
https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-build/490/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-build-worker/540
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-docs/541
    FAILURE: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-test/539/console
    None: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-update-mp/507/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-build/490/rebuild

review: Needs Fixing (continuous-integration)

[Simon Fels (morphis)]

LGTM

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:7e1fb523fc1c845b0a3f0bfc69ec3e7fd04fda56
https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-build/491/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-build-worker/541
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-docs/542
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-test/540
    None: https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-update-mp/508/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/snappy-hwe-snaps-snap-build/491/rebuild

review: Approve (continuous-integration)

diff --git a/.ci_tests_disabled b/.ci_tests_disabled
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/.ci_tests_disabled
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index 1eefdce..ddeea7f 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -918,15 +918,20 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 		/* continuation State exists -> get from cache */
 		sdp_buf_t *pCache = sdp_get_cached_rsp(cstate);
 		if (pCache) {
-			uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
-			pResponse = pCache->data;
-			memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
-			buf->data_size += sent;
-			cstate->cStateValue.maxBytesSent += sent;
-			if (cstate->cStateValue.maxBytesSent == pCache->data_size)
-				cstate_size = sdp_set_cstate_pdu(buf, NULL);
-			else
-				cstate_size = sdp_set_cstate_pdu(buf, cstate);
+			if (cstate->cStateValue.maxBytesSent >= pCache->data_size) {
+				status = SDP_INVALID_CSTATE;
+				SDPDBG("Got bad cstate with invalid size");
+			} else {
+				uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
+				pResponse = pCache->data;
+				memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
+				buf->data_size += sent;
+				cstate->cStateValue.maxBytesSent += sent;
+				if (cstate->cStateValue.maxBytesSent == pCache->data_size)
+					cstate_size = sdp_set_cstate_pdu(buf, NULL);
+				else
+					cstate_size = sdp_set_cstate_pdu(buf, cstate);
+			}
 		} else {
 			status = SDP_INVALID_CSTATE;
 			SDPDBG("Non-null continuation state, but null cache buffer");