Module Name: src
Committed By: maya
Date: Mon Aug 5 13:39:19 UTC 2019
Modified Files:
src/usr.sbin/bta2dpd/bta2dpd: avdtp.c
Log Message:
Avoid read overflows
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 src/usr.sbin/bta2dpd/bta2dpd/avdtp.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/usr.sbin/bta2dpd/bta2dpd/avdtp.c
diff -u src/usr.sbin/bta2dpd/bta2dpd/avdtp.c:1.2 src/usr.sbin/bta2dpd/bta2dpd/avdtp.c:1.3
--- src/usr.sbin/bta2dpd/bta2dpd/avdtp.c:1.2 Wed Jul 25 19:03:50 2018
+++ src/usr.sbin/bta2dpd/bta2dpd/avdtp.c Mon Aug 5 13:39:18 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: avdtp.c,v 1.2 2018/07/25 19:03:50 kamil Exp $ */
+/* $NetBSD: avdtp.c,v 1.3 2019/08/05 13:39:18 maya Exp $ */
/*-
* Copyright (c) 2015 - 2016 Nathanial Sloss <[email protected]>
@@ -210,7 +210,7 @@ avdtpDiscover(uint8_t *buffer, size_t re
bool isSink;
if (recvsize >= 2) {
- for (offset = 0;offset < recvsize;offset += 2) {
+ for (offset = 0; offset < recvsize - 1; offset += 2) {
sepInfo->sep = buffer[offset] >> 2;
sepInfo->media_Type = buffer[offset+1] >> 4;
isSink = (buffer[offset+1] >> 3) & 1;
@@ -313,7 +313,7 @@ avdtpAutoConfigSBC(int fd, int recvfd, u
uint8_t supBitpoolMin, supBitpoolMax, tmp_mask;
size_t i;
- for (i = 0; i < cap_len; i++) {
+ for (i = 0; i < cap_len - 5; i++) {
if (capabilities[i] == mediaTransport &&
capabilities[i + 1] == 0 &&
capabilities[i + 2] == mediaCodec &&
@@ -321,7 +321,7 @@ avdtpAutoConfigSBC(int fd, int recvfd, u
capabilities[i + 5] == SBC_CODEC_ID)
break;
}
- if (i >= cap_len)
+ if (i >= cap_len - 9)
goto auto_config_failed;
availFreqMode = capabilities[i + 6];
