[src/trunk]: src/usr.sbin/bta2dpd/bta2dpd Avoid read overflows

[maya <maya%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/22022a280a24
branches:  trunk
changeset: 453264:22022a280a24
user:      maya <maya%NetBSD.org@localhost>
date:      Mon Aug 05 13:39:18 2019 +0000

description:
Avoid read overflows

diffstat:

 usr.sbin/bta2dpd/bta2dpd/avdtp.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r 0702b45cf0dc -r 22022a280a24 usr.sbin/bta2dpd/bta2dpd/avdtp.c
--- a/usr.sbin/bta2dpd/bta2dpd/avdtp.c  Mon Aug 05 13:30:21 2019 +0000
+++ b/usr.sbin/bta2dpd/bta2dpd/avdtp.c  Mon Aug 05 13:39:18 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: avdtp.c,v 1.2 2018/07/25 19:03:50 kamil Exp $ */
+/* $NetBSD: avdtp.c,v 1.3 2019/08/05 13:39:18 maya Exp $ */
 
 /*-
  * Copyright (c) 2015 - 2016 Nathanial Sloss <nathanialsloss%yahoo.com.au@localhost>
@@ -210,7 +210,7 @@
        bool isSink;
 
        if (recvsize >= 2) {
-               for (offset = 0;offset < recvsize;offset += 2) {
+               for (offset = 0; offset < recvsize - 1; offset += 2) {
                        sepInfo->sep = buffer[offset] >> 2;
                        sepInfo->media_Type = buffer[offset+1] >> 4;
                        isSink = (buffer[offset+1] >> 3) & 1;
@@ -313,7 +313,7 @@
        uint8_t supBitpoolMin, supBitpoolMax, tmp_mask;
        size_t i;
 
-       for (i = 0; i < cap_len; i++) {
+       for (i = 0; i < cap_len - 5; i++) {
                if (capabilities[i] == mediaTransport &&
                    capabilities[i + 1] == 0 &&
                    capabilities[i + 2] == mediaCodec &&
@@ -321,7 +321,7 @@
                    capabilities[i + 5] == SBC_CODEC_ID)
                        break;
        }
-       if (i >= cap_len)
+       if (i >= cap_len - 9)
                goto auto_config_failed;
 
        availFreqMode = capabilities[i + 6];