diff options
| author | Dmitriy Paliy <dmitriy.paliy@nokia.com> | 2011-02-09 16:55:46 +0200 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@nokia.com> | 2011-02-09 14:00:55 -0800 |
| commit | f05cb9d2987f34b2c19f391f8335a20619c88ccf (patch) | |
| tree | d7d7100d66c9905a64dc18dc8a4d5a6732a07fde /audio | |
| parent | bdc943dd18a400a4d15d269577c480eb0ccb51ac (diff) | |
| download | bluez-f05cb9d2987f34b2c19f391f8335a20619c88ccf.tar.gz | |
Fix bluetoothd exit on badly formated AT+VTS
This fixes bluetoothd exit when AT+VTS command is badly formatted,
e.g. as AT+VTS\xfe\xfe[...]=1
Verification it done for the numeric value to be larger than 0x23,
that corresponds to the hash '#', and to be lower than 0x44, that
corresponds to 'D', such that the tone is in {0-9, *, #, A, B, C, D}.
Diffstat (limited to 'audio')
| -rw-r--r-- | audio/headset.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/audio/headset.c b/audio/headset.c index 0270e2c4..bdaa8da9 100644 --- a/audio/headset.c +++ b/audio/headset.c @@ -1015,12 +1015,18 @@ int telephony_transmit_dtmf_rsp(void *telephony_device, cme_error_t err) static int dtmf_tone(struct audio_device *device, const char *buf) { + char tone; + if (strlen(buf) < 8) { error("Too short string for DTMF tone"); return -EINVAL; } - telephony_transmit_dtmf_req(device, buf[7]); + tone = buf[7]; + if (tone >= '#' && tone <= 'D') + telephony_transmit_dtmf_req(device, tone); + else + return -EINVAL; return 0; } |