[PATCHv4 18/20] unit/avrcp: Fix possible buffer overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Andrei Emeltchenko <andrei.emeltchenko@xxxxxxxxx>

text[] needs to be of size number for get_value_text()
---
 unit/test-avrcp.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/unit/test-avrcp.c b/unit/test-avrcp.c
index fdca98f..00fdaff 100644
--- a/unit/test-avrcp.c
+++ b/unit/test-avrcp.c
@@ -431,10 +431,15 @@ static int get_value_text(struct avrcp *session, uint8_t transaction,
 				uint8_t attr, uint8_t number, uint8_t *values,
 				void *user_data)
 {
-	const char *text[] = { "on" };
+	const char *text[number];
 
 	DBG("");
 
+	if (number) {
+		memset(text, 0, number);
+		text[0] = "on";
+	}
+
 	avrcp_get_player_values_text_rsp(session, transaction, number,
 								values, text);
 
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux