From 411360027abe61bc5ba1a244ea694b7c92ddaed9 Mon Sep 17 00:00:00 2001
From: "matthias.ringwald"
 <matthias.ringwald@1a0a8af8-31b5-11de-8e0c-53a27eea117e>
Date: Tue, 14 Jan 2014 10:28:10 +0000
Subject: [PATCH] use fixed size array for RFCOMM Test Response

---
 src/rfcomm.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/rfcomm.c b/src/rfcomm.c
index 84557d203..509bad035 100644
--- a/src/rfcomm.c
+++ b/src/rfcomm.c
@@ -602,9 +602,12 @@ static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fco
 
 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
-    uint8_t payload[2+len]; 
+    uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN]; 
     uint8_t pos = 0;
     payload[pos++] = BT_RFCOMM_TEST_RSP;
+    if (len > RFCOMM_TEST_DATA_MAX_LEN) {
+        len = RFCOMM_TEST_DATA_MAX_LEN;
+    }
     payload[pos++] = (len + 1) << 1 | 1;  // len
     memcpy(&payload[pos], data, len);
     pos += len;