2014-02-28 10:44:12

by Andrei Emeltchenko

Subject: [PATCH] avrcp: Fix buffer size

From: Andrei Emeltchenko <[email protected]>

For avrcp_get_current_player_value() buffer size needs to be
AVRCP_ATTRIBUTE_LAST + 1 for all attributes + 1 for number of attributes
written first, not counting header.
---
profiles/audio/avrcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index c0e5d07..8098c62 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -1905,7 +1905,7 @@ static gboolean avrcp_player_value_rsp(struct avctp *conn,
static void avrcp_get_current_player_value(struct avrcp *session,
uint8_t *attrs, uint8_t count)
{
- uint8_t buf[AVRCP_HEADER_LENGTH + AVRCP_ATTRIBUTE_LAST + 1];
+ uint8_t buf[AVRCP_HEADER_LENGTH + AVRCP_ATTRIBUTE_LAST + 2];
struct avrcp_header *pdu = (void *) buf;
uint16_t length = AVRCP_HEADER_LENGTH + count + 1;

--
1.8.3.2

2014-02-28 11:32:36

by Andrei Emeltchenko

Subject: [PATCH] avrcp: Fix buffer size check

From: Andrei Emeltchenko <[email protected]>

Fix size check taking into account that attributes starts from 1 (0 is
illegal).
---
profiles/audio/avrcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index c0e5d07..48c3355 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -1909,7 +1909,7 @@ static void avrcp_get_current_player_value(struct avrcp *session,
struct avrcp_header *pdu = (void *) buf;
uint16_t length = AVRCP_HEADER_LENGTH + count + 1;

- if (count > AVRCP_ATTRIBUTE_LAST + 1)
+ if (count > AVRCP_ATTRIBUTE_LAST)
return;

memset(buf, 0, sizeof(buf));
--
1.8.3.2

2014-02-28 11:17:14

by Andrei Emeltchenko

Subject: Re: [PATCH] avrcp: Fix buffer size

On Fri, Feb 28, 2014 at 12:44:12PM +0200, Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> For avrcp_get_current_player_value() buffer size needs to be
> AVRCP_ATTRIBUTE_LAST + 1 for all attributes + 1 for number of attributes
> written first, not counting header.

Sorry, please disregard this, attribute 0 should not be used.

> ---
> profiles/audio/avrcp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
> index c0e5d07..8098c62 100644
> --- a/profiles/audio/avrcp.c
> +++ b/profiles/audio/avrcp.c
> @@ -1905,7 +1905,7 @@ static gboolean avrcp_player_value_rsp(struct avctp *conn,
> static void avrcp_get_current_player_value(struct avrcp *session,
> uint8_t *attrs, uint8_t count)
> {
> - uint8_t buf[AVRCP_HEADER_LENGTH + AVRCP_ATTRIBUTE_LAST + 1];
> + uint8_t buf[AVRCP_HEADER_LENGTH + AVRCP_ATTRIBUTE_LAST + 2];
> struct avrcp_header *pdu = (void *) buf;
> uint16_t length = AVRCP_HEADER_LENGTH + count + 1;
>
> --
> 1.8.3.2
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html