mirrors/pulseaudio
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pulseaudio/pulseaudio.git synced 2025-11-03 09:01:50 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

bluetooth: Fix negative array index write

Browse source 
CID 1533121
This commit is contained in:
Peter Meerwald-Stadler 2016-08-16 15:56:40 +02:00
parent aa1882c93f
commit 492aafd93d
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/modules/bluetooth/backend-native.c
View file

@ -231,14 +231,17 @@ static void rfcomm_io_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_i
ssize_t len; ssize_t len;
int gain; int gain;
len = read(fd, buf, 511); len = pa_read(fd, buf, 511, NULL);
if (len < 0) {
pa_log_error("RFCOMM read error: %s", pa_cstrerror(errno));
goto fail;
}
buf[len] = 0; buf[len] = 0;
pa_log_debug("RFCOMM << %s", buf); pa_log_debug("RFCOMM << %s", buf);
if (sscanf(buf, "AT+VGS=%d", &gain) == 1) { if (sscanf(buf, "AT+VGS=%d", &gain) == 1) {
t->speaker_gain = gain; t->speaker_gain = gain;
pa_hook_fire(pa_bluetooth_discovery_hook(t->device->discovery, PA_BLUETOOTH_HOOK_TRANSPORT_SPEAKER_GAIN_CHANGED), t); pa_hook_fire(pa_bluetooth_discovery_hook(t->device->discovery, PA_BLUETOOTH_HOOK_TRANSPORT_SPEAKER_GAIN_CHANGED), t);
} else if (sscanf(buf, "AT+VGM=%d", &gain) == 1) { } else if (sscanf(buf, "AT+VGM=%d", &gain) == 1) {
t->microphone_gain = gain; t->microphone_gain = gain;
pa_hook_fire(pa_bluetooth_discovery_hook(t->device->discovery, PA_BLUETOOTH_HOOK_TRANSPORT_MICROPHONE_GAIN_CHANGED), t); pa_hook_fire(pa_bluetooth_discovery_hook(t->device->discovery, PA_BLUETOOTH_HOOK_TRANSPORT_MICROPHONE_GAIN_CHANGED), t);
@ -259,7 +262,6 @@ static void rfcomm_io_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_i
fail: fail:
pa_bluetooth_transport_unlink(t); pa_bluetooth_transport_unlink(t);
pa_bluetooth_transport_free(t); pa_bluetooth_transport_free(t);
return;
} }
static void transport_destroy(pa_bluetooth_transport *t) { static void transport_destroy(pa_bluetooth_transport *t) {