From 6f15a199e037d789188b3b89e77ac78acee7812f Mon Sep 17 00:00:00 2001 From: Johan Hedberg Date: Thu, 24 Jan 2008 11:16:15 +0000 Subject: Add some buffer length checks --- audio/headset.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'audio/headset.c') diff --git a/audio/headset.c b/audio/headset.c index a02f4fef..6972daf9 100644 --- a/audio/headset.c +++ b/audio/headset.c @@ -176,6 +176,9 @@ static int supported_features(struct device *device, const char *buf) struct headset *hs = device->headset; int err; + if (strlen(buf) < 9) + return -EINVAL; + hs->hfp_features = strtoul(&buf[8], NULL, 10); err = headset_send(hs, "\r\n+BRSF=%u\r\n", ag_features); if (err < 0) @@ -287,6 +290,9 @@ static int cli_notification(struct device *device, const char *buf) { struct headset *hs = device->headset; + if (strlen(buf) < 9) + return -EINVAL; + hs->cli_active = buf[8] == '1' ? TRUE : FALSE; return headset_send(hs, "\r\nOK\r\n"); -- cgit