Skip to content
Snippets Groups Projects
Commit 60d81a55 authored by Ruchi Kandoi's avatar Ruchi Kandoi Committed by Pavlin Radoslavov
Browse files

Fix V535 CWE-691: inner/outer for loop sharing variables

Test: compiles
Bug: 112146072
Change-Id: Ie9e10d727edc652865458298cb59a24ac5732c98
parent 197aeea2
No related branches found
No related tags found
No related merge requests found
......@@ -792,34 +792,33 @@ bool SDP_AddServiceClassIdList(uint32_t handle, uint16_t num_services,
******************************************************************************/
bool SDP_DeleteAttribute(uint32_t handle, uint16_t attr_id) {
#if (SDP_SERVER_ENABLED == TRUE)
uint16_t xx, yy;
tSDP_RECORD* p_rec = &sdp_cb.server_db.record[0];
uint8_t* pad_ptr;
uint32_t len; /* Number of bytes in the entry */
/* Find the record in the database */
for (xx = 0; xx < sdp_cb.server_db.num_records; xx++, p_rec++) {
for (uint16_t xx = 0; xx < sdp_cb.server_db.num_records; xx++, p_rec++) {
if (p_rec->record_handle == handle) {
tSDP_ATTRIBUTE* p_attr = &p_rec->attribute[0];
SDP_TRACE_API("Deleting attr_id 0x%04x for handle 0x%x", attr_id, handle);
/* Found it. Now, find the attribute */
for (xx = 0; xx < p_rec->num_attributes; xx++, p_attr++) {
for (uint16_t yy = 0; yy < p_rec->num_attributes; yy++, p_attr++) {
if (p_attr->id == attr_id) {
pad_ptr = p_attr->value_ptr;
len = p_attr->len;
if (len) {
for (yy = 0; yy < p_rec->num_attributes; yy++) {
if (p_rec->attribute[yy].value_ptr > pad_ptr)
p_rec->attribute[yy].value_ptr -= len;
for (uint16_t zz = 0; zz < p_rec->num_attributes; zz++) {
if (p_rec->attribute[zz].value_ptr > pad_ptr)
p_rec->attribute[zz].value_ptr -= len;
}
}
/* Found it. Shift everything up one */
p_rec->num_attributes--;
for (yy = xx; yy < p_rec->num_attributes; yy++, p_attr++) {
for (uint16_t zz = xx; zz < p_rec->num_attributes; zz++, p_attr++) {
*p_attr = *(p_attr + 1);
}
......@@ -827,7 +826,9 @@ bool SDP_DeleteAttribute(uint32_t handle, uint16_t attr_id) {
if (len) {
xx =
(p_rec->free_pad_ptr - ((pad_ptr + len) - &p_rec->attr_pad[0]));
for (yy = 0; yy < xx; yy++, pad_ptr++) *pad_ptr = *(pad_ptr + len);
for (uint16_t zz = 0; zz < xx; zz++, pad_ptr++) {
*pad_ptr = *(pad_ptr + len);
}
p_rec->free_pad_ptr -= len;
}
return (true);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment