summaryrefslogtreecommitdiffstats
path: root/src/modules/bluetooth
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2009-09-08 23:48:12 +0200
committerLennart Poettering <lennart@poettering.net>2009-09-08 23:48:12 +0200
commit1380f18e52db48f61fd8582c59e52281728f22b7 (patch)
treed6472bb7d80dcf2a32a833db12c2eb771a78a45f /src/modules/bluetooth
parent382eced35de93cba8098610f3990c16ae35b6ea0 (diff)
blueooth: actually honour 'room' variable (llvm-clang-analyzer)
Diffstat (limited to 'src/modules/bluetooth')
-rw-r--r--src/modules/bluetooth/module-bluetooth-device.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/src/modules/bluetooth/module-bluetooth-device.c b/src/modules/bluetooth/module-bluetooth-device.c
index b8a88042..4592fca1 100644
--- a/src/modules/bluetooth/module-bluetooth-device.c
+++ b/src/modules/bluetooth/module-bluetooth-device.c
@@ -221,9 +221,7 @@ static int service_recv(struct userdata *u, bt_audio_msg_header_t *msg, size_t r
pa_assert(u);
pa_assert(u->service_fd >= 0);
pa_assert(msg);
-
- if (room <= 0)
- room = BT_SUGGESTED_BUFFER_SIZE;
+ pa_assert(room >= sizeof(*msg));
pa_log_debug("Trying to receive message from audio service...");
@@ -236,6 +234,11 @@ static int service_recv(struct userdata *u, bt_audio_msg_header_t *msg, size_t r
return -1;
}
+ if (msg->length > room) {
+ pa_log_error("Not enough room.");
+ return -1;
+ }
+
/* Secondly, read the payload */
if (msg->length > sizeof(*msg)) {