public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
* [Bluez PATCH] avdtp: Fix parsing capabilities
@ 2021-06-17  0:53 Archie Pusaka
  2021-06-17  1:25 ` [Bluez] " bluez.test.bot
  0 siblings, 1 reply; 3+ messages in thread
From: Archie Pusaka @ 2021-06-17  0:53 UTC (permalink / raw)
  To: linux-bluetooth, Luiz Augusto von Dentz
  Cc: CrosBT Upstreaming, Archie Pusaka, Alain Michaud, Michael Sun

From: Archie Pusaka <apusaka@chromium.org>

This patch fixes size comparison and variable misassignment.

Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Michael Sun <michaelfsun@google.com>
---

 profiles/audio/avdtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index c7bf99f429..5d13104c10 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -1323,7 +1323,7 @@ static GSList *caps_to_list(uint8_t *data, size_t size,
 
 		cap = (struct avdtp_service_capability *)data;
 
-		if (sizeof(*cap) + cap->length >= size) {
+		if (sizeof(*cap) + cap->length > size) {
 			error("Invalid capability data in getcap resp");
 			break;
 		}
@@ -1345,7 +1345,7 @@ static GSList *caps_to_list(uint8_t *data, size_t size,
 		switch (cap->category) {
 		case AVDTP_MEDIA_CODEC:
 			if (codec)
-				*codec = cap;
+				*codec = cpy;
 			break;
 		case AVDTP_DELAY_REPORTING:
 			if (delay_reporting)
-- 
2.32.0.272.g935e593368-goog


^ permalink raw reply related	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-06-17 20:50 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-06-17  0:53 [Bluez PATCH] avdtp: Fix parsing capabilities Archie Pusaka
2021-06-17  1:25 ` [Bluez] " bluez.test.bot
2021-06-17 20:50   ` Luiz Augusto von Dentz

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox