diff options
| author | Myles Watson <mylesgw@google.com> | 2020-12-04 12:54:27 -0800 |
|---|---|---|
| committer | mosimchah <mosimchah@gmail.com> | 2021-04-13 02:29:09 -0400 |
| commit | 14a57be7b89ddf12d3e8d6da98e666a7c625b451 (patch) | |
| tree | 70e37b1e0e34d32e521bc7b65aaef41aec33efdb /stack/avrc/avrc_api.cc | |
| parent | 72b8b4776ed216ae64221cbfed0d1135fb0446cc (diff) | |
Bug: 174150451
Test: compilation
Tag: #security
Change-Id: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 1f169323d335ab0dc260952c2dd3821144448b11)
Merged-In: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 8d461a866a12cd3d7d6d68551a5d2a7139fab2b9)
(cherry picked from commit 41584e84a3288d4dc9770773fa3db81df209ae4c)
Diffstat (limited to 'stack/avrc/avrc_api.cc')
| -rw-r--r-- | stack/avrc/avrc_api.cc | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/stack/avrc/avrc_api.cc b/stack/avrc/avrc_api.cc index f995b8299..311fc875b 100644 --- a/stack/avrc/avrc_api.cc +++ b/stack/avrc/avrc_api.cc @@ -315,7 +315,7 @@ static uint16_t avrc_send_continue_frag(uint8_t handle, uint8_t label) { if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) { int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset); p_pkt_old = p_fcb->p_fmsg; - p_pkt = (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE); + p_pkt = (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE); p_pkt->len = AVRC_MAX_CTRL_DATA_LEN; p_pkt->offset = AVCT_MSG_OFFSET; p_pkt->layer_specific = p_pkt_old->layer_specific; @@ -425,7 +425,7 @@ static BT_HDR* avrc_proc_vendor_command(uint8_t handle, uint8_t label, } if (status != AVRC_STS_NO_ERROR) { - p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE); + p_rsp = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE); p_rsp->offset = p_pkt->offset; p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset; *p_data++ = AVRC_RSP_REJ; @@ -486,7 +486,7 @@ static uint8_t avrc_proc_far_msg(uint8_t handle, uint8_t label, uint8_t cr, if (pkt_type == AVRC_PKT_START) { /* Allocate buffer for re-assembly */ p_rcb->rasm_pdu = *p_data; - p_rcb->p_rmsg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE); + p_rcb->p_rmsg = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE); /* Copy START packet to buffer for re-assembling fragments */ memcpy(p_rcb->p_rmsg, p_pkt, sizeof(BT_HDR)); /* Copy bt hdr */ @@ -921,7 +921,7 @@ static BT_HDR* avrc_pass_msg(tAVRC_MSG_PASS* p_msg) { CHECK(p_msg != NULL); CHECK(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->pass_len)); - BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE); + BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE); p_cmd->offset = AVCT_MSG_OFFSET; p_cmd->layer_specific = AVCT_DATA_CTRL; @@ -1184,7 +1184,7 @@ uint16_t AVRC_MsgReq(uint8_t handle, uint8_t label, uint8_t ctype, if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) { int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset); BT_HDR* p_pkt_new = - (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE); + (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE); if (p_start != NULL) { p_fcb->frag_enabled = true; p_fcb->p_fmsg = p_pkt; |