mirror/btstack
1
0
Fork 0
mirror of https://github.com/bluekitchen/btstack.git synced 2025-03-03 07:13:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

avdtp_source: use uint32_t for packet size validation

Browse Source
This commit is contained in:
Matthias Ringwald 2021-12-24 14:09:28 +01:00
parent 91b75982ac
commit 2d311568fa
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/classic/avdtp_source.c
View File

@ -204,9 +204,9 @@ int avdtp_source_stream_send_media_payload(uint16_t avdtp_cid, uint8_t local_sei
return 0;
}
uint16_t buffer_size = l2cap_get_remote_mtu_for_local_cid(stream_endpoint->l2cap_media_cid);
uint16_t packet_size = AVDTP_MEDIA_PAYLOAD_HEADER_SIZE + payload_size + 1;
if (packet_size >= buffer_size) return ERROR_CODE_MEMORY_CAPACITY_EXCEEDED;
uint32_t buffer_size = l2cap_get_remote_mtu_for_local_cid(stream_endpoint->l2cap_media_cid);
uint32_t packet_size = AVDTP_MEDIA_PAYLOAD_HEADER_SIZE + payload_size + 1;
if (packet_size > buffer_size) return ERROR_CODE_MEMORY_CAPACITY_EXCEEDED;
l2cap_reserve_packet_buffer();
uint8_t * media_packet = l2cap_get_outgoing_buffer();
@ -214,7 +214,7 @@ int avdtp_source_stream_send_media_payload(uint16_t avdtp_cid, uint8_t local_sei
media_packet[AVDTP_MEDIA_PAYLOAD_HEADER_SIZE] = num_frames; // (fragmentation << 7) | (starting_packet << 6) | (last_packet << 5) | num_frames;
(void)memcpy(&media_packet[AVDTP_MEDIA_PAYLOAD_HEADER_SIZE +1], payload, payload_size);
stream_endpoint->sequence_number++;
l2cap_send_prepared(stream_endpoint->l2cap_media_cid, packet_size);
l2cap_send_prepared(stream_endpoint->l2cap_media_cid, (uint16_t) packet_size);
return packet_size;
}
@ -232,15 +232,15 @@ uint8_t avdtp_source_stream_send_media_payload_rtp(uint16_t avdtp_cid, uint8_t l
return 0;
}
uint16_t buffer_size = l2cap_get_remote_mtu_for_local_cid(stream_endpoint->l2cap_media_cid);
uint16_t packet_size = AVDTP_MEDIA_PAYLOAD_HEADER_SIZE + payload_size;
uint32_t buffer_size = l2cap_get_remote_mtu_for_local_cid(stream_endpoint->l2cap_media_cid);
uint32_t packet_size = AVDTP_MEDIA_PAYLOAD_HEADER_SIZE + payload_size;
if (packet_size > buffer_size) return ERROR_CODE_MEMORY_CAPACITY_EXCEEDED;
l2cap_reserve_packet_buffer();
uint8_t * media_packet = l2cap_get_outgoing_buffer();
avdtp_source_setup_media_header(media_packet, marker, stream_endpoint->sequence_number);
(void)memcpy(&media_packet[AVDTP_MEDIA_PAYLOAD_HEADER_SIZE], payload, payload_size);
stream_endpoint->sequence_number++;
return l2cap_send_prepared(stream_endpoint->l2cap_media_cid, packet_size);
return l2cap_send_prepared(stream_endpoint->l2cap_media_cid, (uint16_t) packet_size);
}
uint8_t avdtp_source_stream_send_media_packet(uint16_t avdtp_cid, uint8_t local_seid, const uint8_t * packet, uint16_t size){