From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Date: Wed, 19 Mar 2014 12:26:58 +0000 (+0200)
Subject: unit/avrcp: Fix possible buffer overflow
X-Git-Tag: android-x86-4.4-r3~4555
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=b7283a1bb9b3776a2361b190fe76127346588f6f;p=android-x86%2Fexternal-bluetooth-bluez.git

unit/avrcp: Fix possible buffer overflow

Parameter passed needs to be of size number otherwise there is buffer
overflow.
---

diff --git a/unit/test-avrcp.c b/unit/test-avrcp.c
index d89954ba1..eb002385f 100644
--- a/unit/test-avrcp.c
+++ b/unit/test-avrcp.c
@@ -317,10 +317,15 @@ static int get_attribute_text(struct avrcp *session, uint8_t transaction,
 					uint8_t number, uint8_t *attrs,
 					void *user_data)
 {
-	const char *text[] = { "equalizer" };
+	const char *text[number];
 
 	DBG("");
 
+	if (number) {
+		memset(text, 0, number);
+		text[0] = "equalizer";
+	}
+
 	avrcp_get_player_attribute_text_rsp(session, transaction, number, attrs,
 									text);