AVRCP: Use calloc to zero reserved fields
Bug: 174150451
Test: compilation
Tag: #security
Change-Id: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 1f169323d335ab0dc260952c2dd3821144448b11)
Merged-In: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 8d461a866a12cd3d7d6d68551a5d2a7139fab2b9)
(cherry picked from commit 41584e84a3288d4dc9770773fa3db81df209ae4c)
diff --git a/stack/avrc/avrc_api.cc b/stack/avrc/avrc_api.cc
index 62b7fe4..6ad7e4f 100644
--- a/stack/avrc/avrc_api.cc
+++ b/stack/avrc/avrc_api.cc
@@ -316,7 +316,7 @@
if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {
int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
p_pkt_old = p_fcb->p_fmsg;
- p_pkt = (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
+ p_pkt = (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
p_pkt->len = AVRC_MAX_CTRL_DATA_LEN;
p_pkt->offset = AVCT_MSG_OFFSET;
p_pkt->layer_specific = p_pkt_old->layer_specific;
@@ -426,7 +426,7 @@
}
if (status != AVRC_STS_NO_ERROR) {
- p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+ p_rsp = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
p_rsp->offset = p_pkt->offset;
p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset;
*p_data++ = AVRC_RSP_REJ;
@@ -487,7 +487,7 @@
if (pkt_type == AVRC_PKT_START) {
/* Allocate buffer for re-assembly */
p_rcb->rasm_pdu = *p_data;
- p_rcb->p_rmsg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+ p_rcb->p_rmsg = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
/* Copy START packet to buffer for re-assembling fragments */
memcpy(p_rcb->p_rmsg, p_pkt, sizeof(BT_HDR)); /* Copy bt hdr */
@@ -922,7 +922,7 @@
CHECK(p_msg != NULL);
CHECK(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->pass_len));
- BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+ BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
p_cmd->offset = AVCT_MSG_OFFSET;
p_cmd->layer_specific = AVCT_DATA_CTRL;
@@ -1190,7 +1190,7 @@
if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {
int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
BT_HDR* p_pkt_new =
- (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
+ (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
if (p_start != NULL) {
p_fcb->frag_enabled = true;
p_fcb->p_fmsg = p_pkt;
diff --git a/stack/avrc/avrc_bld_ct.cc b/stack/avrc/avrc_bld_ct.cc
index 384ae60..4d85d17 100644
--- a/stack/avrc/avrc_bld_ct.cc
+++ b/stack/avrc/avrc_bld_ct.cc
@@ -536,7 +536,7 @@
}
/* allocate and initialize the buffer */
- BT_HDR* p_pkt = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);
+ BT_HDR* p_pkt = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
uint8_t *p_data, *p_start;
p_pkt->layer_specific = chnl;
diff --git a/stack/avrc/avrc_bld_tg.cc b/stack/avrc/avrc_bld_tg.cc
index 1dac160..73da345 100644
--- a/stack/avrc/avrc_bld_tg.cc
+++ b/stack/avrc/avrc_bld_tg.cc
@@ -1322,7 +1322,7 @@
}
/* allocate and initialize the buffer */
- BT_HDR* p_pkt = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+ BT_HDR* p_pkt = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
uint8_t *p_data, *p_start;
p_pkt->layer_specific = chnl;
diff --git a/stack/avrc/avrc_opt.cc b/stack/avrc/avrc_opt.cc
index de42e15..a9ad908 100644
--- a/stack/avrc/avrc_opt.cc
+++ b/stack/avrc/avrc_opt.cc
@@ -51,7 +51,7 @@
CHECK(p_msg != NULL);
CHECK(AVRC_META_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->vendor_len));
- p_cmd = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);
+ p_cmd = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (uint8_t*)(p_cmd + 1) + p_cmd->offset;
@@ -91,7 +91,7 @@
*
*****************************************************************************/
uint16_t AVRC_UnitCmd(uint8_t handle, uint8_t label) {
- BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+ BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
uint8_t* p_data;
p_cmd->offset = AVCT_MSG_OFFSET;
@@ -134,7 +134,7 @@
*
*****************************************************************************/
uint16_t AVRC_SubCmd(uint8_t handle, uint8_t label, uint8_t page) {
- BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+ BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
uint8_t* p_data;
p_cmd->offset = AVCT_MSG_OFFSET;
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 7b64b86..7c63676 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -308,7 +308,7 @@
BE_STREAM_TO_UINT16(player->name.str_len, p);
min_len += player->name.str_len;
if (pkt_len < min_len) goto browse_length_error;
- player->name.p_str = (uint8_t*)osi_malloc(
+ player->name.p_str = (uint8_t*)osi_calloc(
(player->name.str_len + 1) * sizeof(uint8_t));
BE_STREAM_TO_ARRAY(p, player->name.p_str, player->name.str_len);
AVRC_TRACE_DEBUG(
@@ -336,7 +336,7 @@
BE_STREAM_TO_UINT16(folder->name.str_len, p);
min_len += folder->name.str_len;
if (pkt_len < min_len) goto browse_length_error;
- folder->name.p_str = (uint8_t*)osi_malloc(
+ folder->name.p_str = (uint8_t*)osi_calloc(
(folder->name.str_len + 1) * sizeof(uint8_t));
BE_STREAM_TO_ARRAY(p, folder->name.p_str, folder->name.str_len);
AVRC_TRACE_DEBUG("%s type %d playable %d cs %d name len %d",
@@ -488,7 +488,7 @@
AVRC_TRACE_DEBUG("%s AVRC_PDU_SET_BROWSED_PLAYER item: %d len: %d",
__func__, i, folder_name->str_len);
folder_name->p_str =
- (uint8_t*)osi_malloc((folder_name->str_len + 1) * sizeof(uint8_t));
+ (uint8_t*)osi_calloc((folder_name->str_len + 1) * sizeof(uint8_t));
BE_STREAM_TO_ARRAY(p, folder_name->p_str, folder_name->str_len);
}
break;
