2014-03-18 12:24:07

by Andrei Emeltchenko

Subject: [PATCH] android/avrcp: Fix possible buffer overflow

From: Andrei Emeltchenko <[email protected]>

---
android/avrcp-lib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/android/avrcp-lib.c b/android/avrcp-lib.c
index 5bbc407..509b6c1 100644
--- a/android/avrcp-lib.c
+++ b/android/avrcp-lib.c
@@ -831,7 +831,7 @@ int avrcp_set_addressed_player(struct avrcp *session, uint16_t player_id,
int avrcp_get_capabilities_rsp(struct avrcp *session, uint8_t transaction,
uint8_t number, uint8_t *events)
{
- uint8_t pdu[AVRCP_EVENT_LAST];
+ uint8_t pdu[AVRCP_EVENT_LAST + 1];

if (number > AVRCP_EVENT_LAST)
return -EINVAL;
--
1.8.3.2

2014-03-18 12:43:37

by Luiz Augusto von Dentz

Subject: Re: [PATCH] android/avrcp: Fix possible buffer overflow

Hi Andrei,

On Tue, Mar 18, 2014 at 2:24 PM, Andrei Emeltchenko
<[email protected]> wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> ---
> android/avrcp-lib.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/android/avrcp-lib.c b/android/avrcp-lib.c
> index 5bbc407..509b6c1 100644
> --- a/android/avrcp-lib.c
> +++ b/android/avrcp-lib.c
> @@ -831,7 +831,7 @@ int avrcp_set_addressed_player(struct avrcp *session, uint16_t player_id,
> int avrcp_get_capabilities_rsp(struct avrcp *session, uint8_t transaction,
> uint8_t number, uint8_t *events)
> {
> - uint8_t pdu[AVRCP_EVENT_LAST];
> + uint8_t pdu[AVRCP_EVENT_LAST + 1];
>
> if (number > AVRCP_EVENT_LAST)
> return -EINVAL;
> --
> 1.8.3.2

Applied.


--
Luiz Augusto von Dentz