diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 80fbe84..dd8458f 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
static GSList *caps_to_list(uint8_t *data, size_t size,
struct avdtp_service_capability **codec,
- gboolean *delay_reporting)
+ gboolean *delay_reporting,
+ uint8_t *err)
{
struct avdtp_service_capability *cap;
GSList *caps;
cap = (struct avdtp_service_capability *)data;
+ /* Verify that the Media Transport capability's length = 0.
+ * Reject otherwise
+ */
+ if (cap->category == AVDTP_MEDIA_TRANSPORT &&
+ cap->length != 0) {
+ error("Invalid media transport in getcap resp");
+ if (err)
+ *err = AVDTP_BAD_MEDIA_TRANSPORT_FORMAT;
+ break;
+ }
+
if (sizeof(*cap) + cap->length > size) {
error("Invalid capability data in getcap resp");
break;
struct conf_rej rej;
struct avdtp_local_sep *sep;
struct avdtp_stream *stream;
- uint8_t err, category = 0x00;
+ uint8_t err = 0, category = 0x00;
struct btd_service *service;
- GSList *l;
if (size < sizeof(struct setconf_req)) {
error("Too short getcap request");
stream->caps = caps_to_list(req->caps,
size - sizeof(struct setconf_req),
&stream->codec,
- &stream->delay_reporting);
+ &stream->delay_reporting,
+ &err);
+ if (err)
+ goto failed_stream;
if (!stream->caps || !stream->codec) {
err = AVDTP_UNSUPPORTED_CONFIGURATION;
goto failed_stream;
}
- /* Verify that the Media Transport capability's length = 0. Reject otherwise */
- for (l = stream->caps; l != NULL; l = g_slist_next(l)) {
- struct avdtp_service_capability *cap = l->data;
-
- if (cap->category == AVDTP_MEDIA_TRANSPORT && cap->length != 0) {
- err = AVDTP_BAD_MEDIA_TRANSPORT_FORMAT;
- goto failed_stream;
- }
- }
-
if (stream->delay_reporting && session->version < 0x0103)
session->version = 0x0103;
}
sep->caps = caps_to_list(resp->caps, size - sizeof(struct getcap_resp),
- &sep->codec, &sep->delay_reporting);
+ &sep->codec, &sep->delay_reporting,
+ NULL);
return TRUE;
}