Add some buffer length checks

1 files changed, 6 insertions, 0 deletions

diff --git a/audio/headset.c b/audio/headset.c
index a02f4fef..6972daf9 100644
--- a/audio/headset.c
+++ b/audio/headset.c
@@ -176,6 +176,9 @@ static int supported_features(struct device *device, const char *buf)
 	struct headset *hs = device->headset;
 	int err;
 
+	if (strlen(buf) < 9)
+		return -EINVAL;
+
 	hs->hfp_features = strtoul(&buf[8], NULL, 10);
 	err = headset_send(hs, "\r\n+BRSF=%u\r\n", ag_features);
 	if (err < 0)
@@ -287,6 +290,9 @@ static int cli_notification(struct device *device, const char *buf)
 {
 	struct headset *hs = device->headset;
 
+	if (strlen(buf) < 9)
+		return -EINVAL;
+
 	hs->cli_active = buf[8] == '1' ? TRUE : FALSE;
 
 	return headset_send(hs, "\r\nOK\r\n");