From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
---
android/avctp.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/android/avctp.c b/android/avctp.c
index 4556ceb..94f84ad 100644
--- a/android/avctp.c
+++ b/android/avctp.c
@@ -814,10 +814,17 @@ static gboolean session_browsing_cb(GIOChannel *chan, GIOCondition cond,
if (ret <= 0)
goto failed;
+ if (ret < AVCTP_HEADER_LENGTH) {
+ error("Too small AVCTP packet");
+ goto failed;
+ }
+
avctp = (struct avctp_header *) buf;
- if (avctp->packet_type != AVCTP_PACKET_SINGLE)
+ if (avctp->packet_type != AVCTP_PACKET_SINGLE) {
+ error("Invalid packet type");
goto failed;
+ }
operands = buf + AVCTP_HEADER_LENGTH;
ret -= AVCTP_HEADER_LENGTH;
--
1.9.0
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
