diff options
author | Lennart Poettering <lennart@poettering.net> | 2009-09-08 23:48:12 +0200 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2009-09-08 23:48:12 +0200 |
commit | 1380f18e52db48f61fd8582c59e52281728f22b7 (patch) | |
tree | d6472bb7d80dcf2a32a833db12c2eb771a78a45f /src/modules | |
parent | 382eced35de93cba8098610f3990c16ae35b6ea0 (diff) |
blueooth: actually honour 'room' variable (llvm-clang-analyzer)
Diffstat (limited to 'src/modules')
-rw-r--r-- | src/modules/bluetooth/module-bluetooth-device.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/modules/bluetooth/module-bluetooth-device.c b/src/modules/bluetooth/module-bluetooth-device.c index b8a88042..4592fca1 100644 --- a/src/modules/bluetooth/module-bluetooth-device.c +++ b/src/modules/bluetooth/module-bluetooth-device.c @@ -221,9 +221,7 @@ static int service_recv(struct userdata *u, bt_audio_msg_header_t *msg, size_t r pa_assert(u); pa_assert(u->service_fd >= 0); pa_assert(msg); - - if (room <= 0) - room = BT_SUGGESTED_BUFFER_SIZE; + pa_assert(room >= sizeof(*msg)); pa_log_debug("Trying to receive message from audio service..."); @@ -236,6 +234,11 @@ static int service_recv(struct userdata *u, bt_audio_msg_header_t *msg, size_t r return -1; } + if (msg->length > room) { + pa_log_error("Not enough room."); + return -1; + } + /* Secondly, read the payload */ if (msg->length > sizeof(*msg)) { |