blueooth: actually honour 'room' variable (llvm-clang-analyzer)

1 files changed, 6 insertions, 3 deletions

diff --git a/src/modules/bluetooth/module-bluetooth-device.c b/src/modules/bluetooth/module-bluetooth-device.c
index b8a88042..4592fca1 100644
--- a/src/modules/bluetooth/module-bluetooth-device.c
+++ b/src/modules/bluetooth/module-bluetooth-device.c
@@ -221,9 +221,7 @@ static int service_recv(struct userdata *u, bt_audio_msg_header_t *msg, size_t r
     pa_assert(u);
     pa_assert(u->service_fd >= 0);
     pa_assert(msg);
-
-    if (room <= 0)
-        room = BT_SUGGESTED_BUFFER_SIZE;
+    pa_assert(room >= sizeof(*msg));
 
     pa_log_debug("Trying to receive message from audio service...");
 
@@ -236,6 +234,11 @@ static int service_recv(struct userdata *u, bt_audio_msg_header_t *msg, size_t r
         return -1;
     }
 
+    if (msg->length > room) {
+        pa_log_error("Not enough room.");
+        return -1;
+    }
+
     /* Secondly, read the payload */
     if (msg->length > sizeof(*msg)) {