Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81566f73 authored by Myles Watson's avatar Myles Watson
Browse files

AVRCP: Use calloc to zero reserved fields 

Bug: 174150451
Test: compilation
Tag: #security
Change-Id: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit a57c661b)
Merged-In: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 89df81fc)
parent 2a7a21e5

system/stack/avrc/avrc_api.cc

+5 −5
Original line number Diff line number Diff line
@@ -315,7 +315,7 @@ static uint16_t avrc_send_continue_frag(uint8_t handle, uint8_t label) { 
  if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {

    int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);

    p_pkt_old = p_fcb->p_fmsg;

    p_pkt = (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);

    p_pkt = (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);

    p_pkt->len = AVRC_MAX_CTRL_DATA_LEN;

    p_pkt->offset = AVCT_MSG_OFFSET;

    p_pkt->layer_specific = p_pkt_old->layer_specific;
@@ -425,7 +425,7 @@ static BT_HDR* avrc_proc_vendor_command(uint8_t handle, uint8_t label, 
  }



  if (status != AVRC_STS_NO_ERROR) {

    p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

    p_rsp = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);

    p_rsp->offset = p_pkt->offset;

    p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset;

    *p_data++ = AVRC_RSP_REJ;
@@ -486,7 +486,7 @@ static uint8_t avrc_proc_far_msg(uint8_t handle, uint8_t label, uint8_t cr, 
    if (pkt_type == AVRC_PKT_START) {

      /* Allocate buffer for re-assembly */

      p_rcb->rasm_pdu = *p_data;

      p_rcb->p_rmsg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

      p_rcb->p_rmsg = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);

      /* Copy START packet to buffer for re-assembling fragments */

      memcpy(p_rcb->p_rmsg, p_pkt, sizeof(BT_HDR)); /* Copy bt hdr */
@@ -921,7 +921,7 @@ static BT_HDR* avrc_pass_msg(tAVRC_MSG_PASS* p_msg) { 
  CHECK(p_msg != NULL);

  CHECK(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->pass_len));



  BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);

  BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);

  p_cmd->offset = AVCT_MSG_OFFSET;

  p_cmd->layer_specific = AVCT_DATA_CTRL;
@@ -1184,7 +1184,7 @@ uint16_t AVRC_MsgReq(uint8_t handle, uint8_t label, uint8_t ctype, 
    if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {

      int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);

      BT_HDR* p_pkt_new =

          (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);

          (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);

      if (p_start != NULL) {

        p_fcb->frag_enabled = true;

        p_fcb->p_fmsg = p_pkt;

system/stack/avrc/avrc_bld_ct.cc

+1 −1
Original line number Diff line number Diff line
@@ -519,7 +519,7 @@ static BT_HDR* avrc_bld_init_cmd_buffer(tAVRC_COMMAND* p_cmd) { 
  }



  /* allocate and initialize the buffer */

  BT_HDR* p_pkt = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);

  BT_HDR* p_pkt = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);

  uint8_t *p_data, *p_start;



  p_pkt->layer_specific = chnl;

system/stack/avrc/avrc_bld_tg.cc

+1 −1
Original line number Diff line number Diff line
@@ -1322,7 +1322,7 @@ static BT_HDR* avrc_bld_init_rsp_buffer(tAVRC_RESPONSE* p_rsp) { 
  }



  /* allocate and initialize the buffer */

  BT_HDR* p_pkt = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

  BT_HDR* p_pkt = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);

  uint8_t *p_data, *p_start;



  p_pkt->layer_specific = chnl;

system/stack/avrc/avrc_opt.cc

+3 −3
Original line number Diff line number Diff line
@@ -51,7 +51,7 @@ static BT_HDR* avrc_vendor_msg(tAVRC_MSG_VENDOR* p_msg) { 
  CHECK(p_msg != NULL);



  CHECK(AVRC_META_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->vendor_len));

  p_cmd = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);

  p_cmd = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);



  p_cmd->offset = AVCT_MSG_OFFSET;

  p_data = (uint8_t*)(p_cmd + 1) + p_cmd->offset;
@@ -91,7 +91,7 @@ static BT_HDR* avrc_vendor_msg(tAVRC_MSG_VENDOR* p_msg) { 
 *

 *****************************************************************************/

uint16_t AVRC_UnitCmd(uint8_t handle, uint8_t label) {

  BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);

  BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);

  uint8_t* p_data;



  p_cmd->offset = AVCT_MSG_OFFSET;
@@ -134,7 +134,7 @@ uint16_t AVRC_UnitCmd(uint8_t handle, uint8_t label) { 
 *

 *****************************************************************************/

uint16_t AVRC_SubCmd(uint8_t handle, uint8_t label, uint8_t page) {

  BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);

  BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);

  uint8_t* p_data;



  p_cmd->offset = AVCT_MSG_OFFSET;

system/stack/avrc/avrc_pars_ct.cc

+3 −3
Original line number Diff line number Diff line
@@ -299,7 +299,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg, 
            BE_STREAM_TO_UINT16(player->name.str_len, p);

            min_len += player->name.str_len;

            if (pkt_len < min_len) goto browse_length_error;

            player->name.p_str = (uint8_t*)osi_malloc(

            player->name.p_str = (uint8_t*)osi_calloc(

                (player->name.str_len + 1) * sizeof(uint8_t));

            BE_STREAM_TO_ARRAY(p, player->name.p_str, player->name.str_len);

            AVRC_TRACE_DEBUG(
@@ -327,7 +327,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg, 
            BE_STREAM_TO_UINT16(folder->name.str_len, p);

            min_len += folder->name.str_len;

            if (pkt_len < min_len) goto browse_length_error;

            folder->name.p_str = (uint8_t*)osi_malloc(

            folder->name.p_str = (uint8_t*)osi_calloc(

                (folder->name.str_len + 1) * sizeof(uint8_t));

            BE_STREAM_TO_ARRAY(p, folder->name.p_str, folder->name.str_len);

            AVRC_TRACE_DEBUG("%s type %d playable %d cs %d name len %d",
@@ -455,7 +455,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg, 
        AVRC_TRACE_DEBUG("%s AVRC_PDU_SET_BROWSED_PLAYER item: %d len: %d",

                         __func__, i, folder_name->str_len);

        folder_name->p_str =

            (uint8_t*)osi_malloc((folder_name->str_len + 1) * sizeof(uint8_t));

            (uint8_t*)osi_calloc((folder_name->str_len + 1) * sizeof(uint8_t));

        BE_STREAM_TO_ARRAY(p, folder_name->p_str, folder_name->str_len);

      }

      break;