--- bluez-sdp-1.4/sdpd/request.c	Wed Feb 12 05:18:07 2003
+++ bluez-sdp-1.4-mods/sdpd/request.c	Thu Sep  4 14:28:12 2003
@@ -228,7 +228,7 @@
  */
 static int service_search_req(sdp_req_t *req, sdp_buf_t *buf)
 {
-	int status = 0, i;
+	int status = 0, i, plen;
 	sdp_list_t *pattern = NULL;
 	int expected, actual;
 	uint8_t dtd;
@@ -249,6 +249,14 @@
 		goto done;
 	}
 	pdata += scanned;
+
+	plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
+	if((plen < (scanned + sizeof(uint16_t) + 1)) || // To ensure we don't read past buffer
+	   (plen != (scanned + sizeof(uint16_t) + 1 + *((uint8_t *)(pdata+sizeof(uint16_t)))))) {
+	  status = SDP_INVALID_SYNTAX;
+	  goto done;
+	}
+
 	expected = ntohs(sdp_get_unaligned((uint16_t *)pdata));
 	
 	SDPDBG("Expected count: %d\n", expected);
@@ -285,7 +293,7 @@
 		sdp_list_t *list = sdp_get_record_list();
 
 		handleSize = 0;
-		for (; list; list = list->next) {
+		for (; list && rsp_count < expected; list = list->next) {
 			sdp_record_t *rec = (sdp_record_t *)list->data;
 
 			SDPDBG("Checking svcRec : 0x%x\n", rec->handle);
@@ -480,7 +488,7 @@
 	uint8_t dtd = 0;
 	int scanned = 0;
 	int max_rsp_size;
-	int status = 0;
+	int status = 0, plen;
 	char *pdata = req->buf + sizeof(sdp_pdu_hdr_t);
 	uint32_t handle = ntohl(sdp_get_unaligned((uint32_t *)pdata));
 
@@ -498,6 +506,13 @@
 	}
 	pdata += scanned;
 
+	plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
+	if((plen < (scanned + sizeof(uint32_t) + sizeof(uint16_t) + 1)) || // To ensure we don't read past buffer
+	   (plen != (scanned + sizeof(uint32_t) + sizeof(uint16_t) + 1 + *((uint8_t *)pdata)))) {
+	  status = SDP_INVALID_SYNTAX;
+	  goto done;
+	}
+
 	/*
 	 * if continuation state exists, attempt
 	 * to get rsp remainder from cache, else send error
@@ -584,7 +599,7 @@
  */
 static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 {
-	int status = 0;
+	int status = 0, plen, totscanned;
 	char *pdata, *pResponse = NULL;
 	int scanned, max, rsp_count = 0;
 	sdp_list_t *pattern = NULL, *seq = NULL, *svcList;
@@ -600,6 +615,7 @@
         	status = SDP_INVALID_SYNTAX;
 		goto done;
 	}
+	totscanned = scanned;
 
 	SDPDBG("Bytes scanned: %d", scanned);
 
@@ -616,6 +632,14 @@
 		goto done;
 	}
 	pdata += scanned;
+	totscanned += scanned;
+
+	plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
+	if((plen < (totscanned + sizeof(uint16_t) + 1)) || // To ensure we don't read past buffer
+	   (plen != (totscanned + sizeof(uint16_t) + 1 + *((uint8_t *)pdata)))) {
+	  status = SDP_INVALID_SYNTAX;
+	  goto done;
+	}
 
 	/*
 	 * if continuation state exists attempt