diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2014-05-07 15:08:34 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2014-05-07 19:40:05 +0300 |
| commit | 75a0706dc5aee143d5838363f3d51ff5862d5a4a (patch) | |
| tree | d3703a083f29444124ef645e0db2a20969f4fadc /android/avrcp-lib.c | |
| parent | aadd3c8c7d5e080db0ea91d91f4c39271fadae26 (diff) | |
| download | bluez-75a0706dc5aee143d5838363f3d51ff5862d5a4a.tar.gz | |
android/avrcp-lib: Fix avrcp_get_player_value_text
This fixes avrcp_get_player_value_text which is crashing due to use of
uninitialized memory and generates invalid PDUs.
Diffstat (limited to 'android/avrcp-lib.c')
| -rw-r--r-- | android/avrcp-lib.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/android/avrcp-lib.c b/android/avrcp-lib.c index 077343f9b..7f80596c7 100644 --- a/android/avrcp-lib.c +++ b/android/avrcp-lib.c @@ -1600,15 +1600,19 @@ int avrcp_get_player_value_text(struct avrcp *session, uint8_t attr, uint8_t number, uint8_t *values) { struct iovec iov[2]; + uint8_t pdu[2]; if (!number) return -EINVAL; - iov[0].iov_base = &attr; - iov[0].iov_len = sizeof(attr); + pdu[0] = attr; + pdu[1] = number; + + iov[0].iov_base = pdu; + iov[0].iov_len = sizeof(pdu); iov[1].iov_base = values; - iov[0].iov_len = number; + iov[1].iov_len = number; return avrcp_send_req(session, AVC_CTYPE_STATUS, AVC_SUBUNIT_PANEL, AVRCP_GET_PLAYER_VALUE_TEXT, iov, 2, |