diff --git a/android/hal-handsfree.c b/android/hal-handsfree.c
index 4117ed0..5f484fe 100644
--- a/android/hal-handsfree.c
+++ b/android/hal-handsfree.c
static void handle_dial(void *buf, uint16_t len)
{
struct hal_ev_handsfree_dial *ev = buf;
+ uint16_t num_len = ev->number_len;
- if (len != sizeof(*ev) + ev->number_len) {
+ if (len != sizeof(*ev) + num_len ||
+ (num_len != 0 && ev->number[num_len - 1] != '\0')) {
error("invalid dial event, aborting");
exit(EXIT_FAILURE);
}
{
struct hal_ev_handsfree_unknown_at *ev = buf;
- if (len != sizeof(*ev) + ev->len) {
+ if (len != sizeof(*ev) + ev->len ||
+ (ev->len != 0 && ev->buf[ev->len - 1] != '\0')) {
error("invalid unknown command event, aborting");
exit(EXIT_FAILURE);
}
if (!cops)
return BT_STATUS_PARM_INVALID;
- cmd->len = strlen(cops);
+ cmd->len = strlen(cops) + 1;
memcpy(cmd->buf, cops, cmd->len);
len = sizeof(*cmd) + cmd->len;
if (!rsp)
return BT_STATUS_PARM_INVALID;
- cmd->len = strlen(rsp);
+ cmd->len = strlen(rsp) + 1;
memcpy(cmd->buf, rsp, cmd->len);
len = sizeof(*cmd) + cmd->len;
cmd->type = type;
if (number) {
- cmd->number_len = strlen(number);
+ cmd->number_len = strlen(number) + 1;
memcpy(cmd->number, number, cmd->number_len);
} else {
cmd->number_len = 0;
cmd->type = type;
if (number) {
- cmd->number_len = strlen(number);
+ cmd->number_len = strlen(number) + 1;
memcpy(cmd->number, number, cmd->number_len);
} else {
cmd->number_len = 0;
diff --git a/android/handsfree.c b/android/handsfree.c
index 76a2de2..fa0726a 100644
--- a/android/handsfree.c
+++ b/android/handsfree.c
static void handle_cops(const void *buf, uint16_t len)
{
const struct hal_cmd_handsfree_cops_response *cmd = buf;
- char operator[17];
- if (len != sizeof(*cmd) + cmd->len) {
+ if (len != sizeof(*cmd) + cmd->len ||
+ (cmd->len != 0 && cmd->buf[cmd->len - 1] != '\0')) {
error("Invalid cops response command, terminating");
raise(SIGTERM);
return;
DBG("");
- memset(operator, 0, sizeof(operator));
- memcpy(operator, cmd->buf, MIN(cmd->len, 16));
-
- hfp_gw_send_info(device.gw, "+COPS: 0,0,\"%s\" ", operator);
+ hfp_gw_send_info(device.gw, "+COPS: 0,0,\"%.16s\"",
+ cmd->len ? (char *) cmd->buf : "");
hfp_gw_send_result(device.gw, HFP_RESULT_OK);