diff options
| author | Myles Watson <mylesgw@google.com> | 2020-12-04 12:54:27 -0800 |
|---|---|---|
| committer | mosimchah <mosimchah@gmail.com> | 2021-04-13 02:29:09 -0400 |
| commit | 14a57be7b89ddf12d3e8d6da98e666a7c625b451 (patch) | |
| tree | 70e37b1e0e34d32e521bc7b65aaef41aec33efdb /stack/avrc/avrc_pars_ct.cc | |
| parent | 72b8b4776ed216ae64221cbfed0d1135fb0446cc (diff) | |
Bug: 174150451
Test: compilation
Tag: #security
Change-Id: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 1f169323d335ab0dc260952c2dd3821144448b11)
Merged-In: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 8d461a866a12cd3d7d6d68551a5d2a7139fab2b9)
(cherry picked from commit 41584e84a3288d4dc9770773fa3db81df209ae4c)
Diffstat (limited to 'stack/avrc/avrc_pars_ct.cc')
| -rw-r--r-- | stack/avrc/avrc_pars_ct.cc | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc index 39ed921d9..aacad08a7 100644 --- a/stack/avrc/avrc_pars_ct.cc +++ b/stack/avrc/avrc_pars_ct.cc @@ -308,7 +308,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg, BE_STREAM_TO_UINT16(player->name.str_len, p); min_len += player->name.str_len; if (pkt_len < min_len) goto browse_length_error; - player->name.p_str = (uint8_t*)osi_malloc( + player->name.p_str = (uint8_t*)osi_calloc( (player->name.str_len + 1) * sizeof(uint8_t)); BE_STREAM_TO_ARRAY(p, player->name.p_str, player->name.str_len); AVRC_TRACE_DEBUG( @@ -336,7 +336,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg, BE_STREAM_TO_UINT16(folder->name.str_len, p); min_len += folder->name.str_len; if (pkt_len < min_len) goto browse_length_error; - folder->name.p_str = (uint8_t*)osi_malloc( + folder->name.p_str = (uint8_t*)osi_calloc( (folder->name.str_len + 1) * sizeof(uint8_t)); BE_STREAM_TO_ARRAY(p, folder->name.p_str, folder->name.str_len); AVRC_TRACE_DEBUG("%s type %d playable %d cs %d name len %d", @@ -464,7 +464,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg, AVRC_TRACE_DEBUG("%s AVRC_PDU_SET_BROWSED_PLAYER item: %d len: %d", __func__, i, folder_name->str_len); folder_name->p_str = - (uint8_t*)osi_malloc((folder_name->str_len + 1) * sizeof(uint8_t)); + (uint8_t*)osi_calloc((folder_name->str_len + 1) * sizeof(uint8_t)); BE_STREAM_TO_ARRAY(p, folder_name->p_str, folder_name->str_len); } break; |