korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2024-11-25 21:24:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

AVRCP: Check if len matches number of IDs

Browse Source 
If number of attributes remote side provided is larger than the length
we read, we would read garbage from stack memory.
This commit is contained in:
Lucas De Marchi 2011-10-12 12:11:19 -03:00 committed by Johan Hedberg
parent 28b3057757
commit 7cddeb379d
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
audio/avrcp.c
View File

@ -597,12 +597,16 @@ static uint8_t avrcp_handle_get_element_attributes(struct avrcp_player *player,
int size;
unsigned int i;
if (len < 8 || *identifier != 0)
if (len < 9 || *identifier != 0)
goto err;
nattr = pdu->params[8];
if (len < nattr * sizeof(uint32_t) + 1)
goto err;
len = 0;
pos = 1; /* Keep track of current position in reponse */
nattr = pdu->params[8];
if (!nattr) {
/*