diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2012-09-25 10:58:40 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2012-09-26 20:12:07 +0300 |
| commit | 19127fd42ddf19d9eb4335ce0ff10f25c920ebee (patch) | |
| tree | 846ca229706c20af1eda96893c6a900cba0cb4ae | |
| parent | 5fd6b1f226e2cc5ded22b32be72d26ef9ac03518 (diff) | |
| download | bluez-19127fd42ddf19d9eb4335ce0ff10f25c920ebee.tar.gz | |
AVRCP: Fix handler lookup for undefined control PDU ids
The lookup table of handlers is not NULL terminated which in case of an
undefined id may lead to read invalid memory out of the table area.
To fix this the id 0x00 is now used as delimiter.
| -rw-r--r-- | audio/avrcp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/audio/avrcp.c b/audio/avrcp.c index 7258e7abd..e7d6771c8 100644 --- a/audio/avrcp.c +++ b/audio/avrcp.c @@ -1086,7 +1086,7 @@ static size_t handle_vendordep_pdu(struct avctp *session, uint8_t transaction, goto err_metadata; } - for (handler = handlers; handler; handler++) { + for (handler = handlers; handler->pdu_id; handler++) { if (handler->pdu_id == pdu->pdu_id) break; } |