Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6095af2 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

fix too small buffer 

property_get must be called with a buffer of at least
PROPERTY_VALUE_MAX len. The supplied buffer is too small.
Fixed.

Change-Id: I6c6b3050b30f6aa5ece69888263394e572551aff
parent c1ece74b

system/btif/src/btif_dm.c

+3 −3
Original line number Diff line number Diff line
@@ -1751,7 +1751,7 @@ void btif_dm_set_oob_for_io_req(tBTA_OOB_DATA *p_oob_data) 
#ifdef BTIF_DM_OOB_TEST

void btif_dm_load_local_oob(void)

{

    char prop_oob[32];

    char prop_oob[PROPERTY_VALUE_MAX];

    property_get("service.brcm.bt.oob", prop_oob, "3");

    BTIF_TRACE_DEBUG1("btif_dm_load_local_oob prop_oob = %s",prop_oob);

    if (prop_oob[0] != '3')
@@ -1775,7 +1775,7 @@ void btif_dm_proc_loc_oob(BOOLEAN valid, BT_OCTET16 c, BT_OCTET16 r) 
    char *path_a = "/data/misc/bluedroid/LOCAL/a.key";

    char *path_b = "/data/misc/bluedroid/LOCAL/b.key";

    char *path = NULL;

    char prop_oob[32];

    char prop_oob[PROPERTY_VALUE_MAX];

    BTIF_TRACE_DEBUG1("btif_dm_proc_loc_oob: valid=%d", valid);

    if (oob_cb.sp_c[0] == 0 && oob_cb.sp_c[1] == 0 &&

        oob_cb.sp_c[2] == 0 && oob_cb.sp_c[3] == 0 &&
@@ -1814,7 +1814,7 @@ BOOLEAN btif_dm_proc_rmt_oob(BD_ADDR bd_addr, BT_OCTET16 p_c, BT_OCTET16 p_r) 
    char *path_a = "/data/misc/bluedroid/LOCAL/a.key";

    char *path_b = "/data/misc/bluedroid/LOCAL/b.key";

    char *path = NULL;

    char prop_oob[32];

    char prop_oob[PROPERTY_VALUE_MAX];

    BOOLEAN result = FALSE;

    bt_bdaddr_t bt_bd_addr;

    bdcpy(oob_cb.oob_bdaddr, bd_addr);