From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Luiz Augusto von Dentz To: linux-bluetooth@vger.kernel.org Subject: [PATCH BlueZ 4/5 v2] AVRCP: Fix not checking for invalid player name length Date: Thu, 7 Mar 2013 17:11:58 +0200 Message-Id: <1362669119-10890-4-git-send-email-luiz.dentz@gmail.com> In-Reply-To: <1362669119-10890-1-git-send-email-luiz.dentz@gmail.com> References: <1362669119-10890-1-git-send-email-luiz.dentz@gmail.com> Sender: linux-bluetooth-owner@vger.kernel.org List-ID: From: Luiz Augusto von Dentz This adds checks for invalid player name length that could cause crashes while reading invalid memory. --- profiles/audio/avrcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c index afb8c09..192a466 100644 --- a/profiles/audio/avrcp.c +++ b/profiles/audio/avrcp.c @@ -2093,7 +2093,7 @@ static void avrcp_parse_media_player_item(struct avrcp *session, avrcp_player_parse_features(player, &operands[8]); namelen = bt_get_be16(&operands[26]); - if (namelen != 0) { + if (namelen != 0 && namelen + 28 == len) { namelen = MIN(namelen, sizeof(name) - 1); memcpy(name, &operands[28], namelen); name[namelen] = '\0'; -- 1.8.1.4