OSDN Git Service

unit/avrcp: Fix possible buffer overflow
authorAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Wed, 19 Mar 2014 12:26:58 +0000 (14:26 +0200)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Mon, 24 Mar 2014 11:41:36 +0000 (13:41 +0200)
Parameter passed needs to be of size number otherwise there is buffer
overflow.

unit/test-avrcp.c

index d89954b..eb00238 100644 (file)
@@ -317,10 +317,15 @@ static int get_attribute_text(struct avrcp *session, uint8_t transaction,
                                        uint8_t number, uint8_t *attrs,
                                        void *user_data)
 {
-       const char *text[] = { "equalizer" };
+       const char *text[number];
 
        DBG("");
 
+       if (number) {
+               memset(text, 0, number);
+               text[0] = "equalizer";
+       }
+
        avrcp_get_player_attribute_text_rsp(session, transaction, number, attrs,
                                                                        text);