diff --git a/example/sdp_bnep_query.c b/example/sdp_bnep_query.c
index 52ad80771..e99d44e5c 100644
--- a/example/sdp_bnep_query.c
+++ b/example/sdp_bnep_query.c
@@ -124,7 +124,7 @@ static void packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *pack
 }
 /* LISTING_END */
 
-static char * get_string_from_data_element(uint8_t * element){
+static void get_string_from_data_element(uint8_t * element, uint16_t buffer_size, char * buffer_data){
     de_size_t de_size = de_get_size_type(element);
     int pos     = de_get_header_size(element);
     int len = 0;
@@ -138,10 +138,9 @@ static char * get_string_from_data_element(uint8_t * element){
         default:
             break;
     }
-    char * str = (char*)malloc(len+1);
-    memcpy(str, &element[pos], len);
-    str[len] ='\0';
-    return str; 
+    uint16_t bytes_to_copy = btstack_min(buffer_size-1,len);
+    memcpy(buffer_data, &element[pos], bytes_to_copy);
+    buffer_data[bytes_to_copy] ='\0';
 }
 
 
@@ -163,7 +162,7 @@ static void handle_sdp_client_query_result(uint8_t packet_type, uint16_t channel
     /* LISTING_PAUSE */
     des_iterator_t des_list_it;
     des_iterator_t prot_it;
-    char *str;
+    char str[20];
 
     switch (hci_event_packet_get_type(packet)){
         case SDP_EVENT_QUERY_ATTRIBUTE_VALUE:
@@ -207,7 +206,7 @@ static void handle_sdp_client_query_result(uint8_t packet_type, uint16_t channel
                     case 0x0100:
                     // 0x0101 "Service Description"
                     case 0x0101:
-                        str = get_string_from_data_element(attribute_value);
+                        get_string_from_data_element(attribute_value, sizeof(str), str);
                         printf(" ** Attribute 0x%04x: %s\n", sdp_event_query_attribute_byte_get_attribute_id(packet), str);
                         free(str);
                         break;