Re: [PATCH v2 1/7] Fix invalid memory access when EIR field length is zero

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

2010/11/11 Vinicius Costa Gomes <vinicius.gomes@xxxxxxxxxxxxx>:
> From: Bruna Moreira <bruna.moreira@xxxxxxxxxxxxx>
>
> ---
>  src/adapter.c |    3 +--
>  1 files changed, 1 insertions(+), 2 deletions(-)
>
> diff --git a/src/adapter.c b/src/adapter.c
> index b1aabbd..8b742b7 100644
> --- a/src/adapter.c
> +++ b/src/adapter.c
> @@ -2977,14 +2977,13 @@ static char **get_eir_uuids(uint8_t *eir_data, size_t *uuid_count)
>        unsigned int i;
>
>        while (len < EIR_DATA_LENGTH - 1) {
> -               uint8_t type = eir_data[1];
>                uint8_t field_len = eir_data[0];
>
>                /* Check for the end of EIR */
>                if (field_len == 0)
>                        break;
>
> -               switch (type) {
> +               switch (eir_data[1]) {
>                case EIR_UUID16_SOME:
>                case EIR_UUID16_ALL:
>                        uuid16_count = field_len / 2;

IMO type is easier to understand here, we just need to initialize it
latter after the length check.


-- 
Luiz Augusto von Dentz
Computer Engineer
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux