Fix stack-buffer-overflow

[Version] 0.1.5
[Profile] Mobile
[Issue Type] Bug Fix

Change-Id: I1ec8a3b7da4c726f9b92ccd00e68669de6435a0c

diff --git a/packaging/audio-hal-sc7727.spec b/packaging/audio-hal-sc7727.spec
index 52f9c7b..fba65ef 100644 (file)
--- a/packaging/audio-hal-sc7727.spec
+++ b/packaging/audio-hal-sc7727.spec
@@ -1,6 +1,6 @@
 Name:       audio-hal-sc7727
 Summary:    TIZEN Audio HAL for SC7727
-Version:    0.1.4
+Version:    0.1.5
 Release:    0
 Group:      System/Libraries
 License:    Apache-2.0

diff --git a/tizen-audio-modem.c b/tizen-audio-modem.c
index 0154e26..fbb1e6b 100644 (file)
--- a/tizen-audio-modem.c
+++ b/tizen-audio-modem.c
@@ -750,38 +750,34 @@ static audio_return_t __vbc_control_close(audio_hal_t *ah)
     return AUDIO_RET_OK;
 }
 
-static vbc_ctrl_pipe_para_t *__audio_modem_create(audio_modem_t  *modem, const char *num)
+static void __audio_modem_create(audio_modem_t *modem, const char *num)
 {
     if (!atoi((char *)num)) {
         AUDIO_LOG_ERROR("Unnormal modem num!");
-        return NULL;
+        return;
     }
 
     modem->num = atoi((char *)num);
     /* check if we need to allocate  space for modem profile */
-    if(!modem->vbc_ctrl_pipe_info) {
+    if (!modem->vbc_ctrl_pipe_info) {
         modem->vbc_ctrl_pipe_info = malloc(modem->num * sizeof(vbc_ctrl_pipe_para_t));
-
         if (modem->vbc_ctrl_pipe_info == NULL) {
             AUDIO_LOG_ERROR("Unable to allocate modem profiles");
-            return NULL;
-        } else {
-            /* initialise the new profile */
-            memset((void*)modem->vbc_ctrl_pipe_info, 0x00, modem->num * sizeof(vbc_ctrl_pipe_para_t));
+            return;
         }
+
+        /* initialise the new profile */
+        memset((void*)modem->vbc_ctrl_pipe_info, 0x00, modem->num * sizeof(vbc_ctrl_pipe_para_t));
     }
 
-    AUDIO_LOG_DEBUG("peter: modem num is %d",modem->num);
-    /* return the profile just added */
-    return modem->vbc_ctrl_pipe_info;
+    AUDIO_LOG_DEBUG("peter: modem num is %d", modem->num);
 }
 
 
 static void __audio_modem_start_tag(void *data, const XML_Char *tag_name,
         const XML_Char **attr)
 {
-    struct modem_config_parse_state *state = data;
-    audio_modem_t *modem = state->modem_info;
+    audio_modem_t *modem = (audio_modem_t *)data;
 
     /* Look at tags */
     if (strcmp(tag_name, "audio") == 0) {
@@ -794,12 +790,12 @@ static void __audio_modem_start_tag(void *data, const XML_Char *tag_name,
         /* Obtain the modem num */
         if (strcmp(attr[0], "num") == 0) {
             AUDIO_LOG_DEBUG("The modem num is '%s'", attr[1]);
-            state->vbc_ctrl_pipe_info = __audio_modem_create(modem, attr[1]);
+            __audio_modem_create(modem, attr[1]);
         } else {
             AUDIO_LOG_ERROR("no modem num!");
         }
     } else if (strcmp(tag_name, "cp") == 0) {
-        if (state->vbc_ctrl_pipe_info) {
+        if (modem->vbc_ctrl_pipe_info) {
             /* Obtain the modem name  \pipe\vbc   filed */
             if (strcmp(attr[0], "name") != 0) {
                 AUDIO_LOG_ERROR("Unnamed modem!");
@@ -816,15 +812,15 @@ static void __audio_modem_start_tag(void *data, const XML_Char *tag_name,
             AUDIO_LOG_DEBUG("cp name is '%s', pipe is '%s',vbc is '%s'", attr[1], attr[3],attr[5]);
             if(strcmp(attr[1], "w") == 0)
             {
-                state->vbc_ctrl_pipe_info->cp_type = CP_W;
+                modem->vbc_ctrl_pipe_info->cp_type = CP_W;
             }
             else if(strcmp(attr[1], "t") == 0)
             {
-                state->vbc_ctrl_pipe_info->cp_type = CP_TG;
+                modem->vbc_ctrl_pipe_info->cp_type = CP_TG;
             }
-            memcpy((void*)state->vbc_ctrl_pipe_info->s_vbc_ctrl_pipe_name,(void*)attr[3],strlen((char *)attr[3]));
-            state->vbc_ctrl_pipe_info->channel_id = atoi((char *)attr[5]);
-            state->vbc_ctrl_pipe_info++;
+            memcpy((void*)modem->vbc_ctrl_pipe_info->s_vbc_ctrl_pipe_name,(void*)attr[3],strlen((char *)attr[3]));
+            modem->vbc_ctrl_pipe_info->channel_id = atoi((char *)attr[5]);
+            modem->vbc_ctrl_pipe_info++;
 
         } else {
             AUDIO_LOG_ERROR("error profile!");
@@ -917,16 +913,8 @@ static void __audio_modem_end_tag(void *data, const XML_Char *tag_name)
     return;
 }
 
-struct config_parse_state {
-    audio_modem_t *modem_info;
- /* To do : pga control setting*/
- /* struct audio_pga *pga; */
- /* struct pga_profile *profile; */
- /* struct pga_attribute_item *attribute_item; */
-};
 static audio_modem_t * __audio_modem_parse (void)
 {
-    struct config_parse_state state;
     XML_Parser parser;
     FILE *file;
     int bytes_read;
@@ -954,9 +942,7 @@ static audio_modem_t * __audio_modem_parse (void)
         goto err_parser_create;
     }
 
-    memset(&state, 0, sizeof(state));
-    state.modem_info = modem;
-    XML_SetUserData(parser, &state);
+    XML_SetUserData(parser, modem);
     XML_SetElementHandler(parser, __audio_modem_start_tag, __audio_modem_end_tag);
 
     for (;;) {

diff --git a/vb_control_parameters.h b/vb_control_parameters.h
index 0b64e66..9df9c16 100644 (file)
--- a/vb_control_parameters.h
+++ b/vb_control_parameters.h
@@ -105,12 +105,6 @@ typedef struct{
        int num;
        audio_mode_item_t *audio_mode_item_info;
 }aud_mode_t;
-struct modem_config_parse_state{
-       audio_modem_t *modem_info;
-       vbc_ctrl_pipe_para_t *vbc_ctrl_pipe_info;
-       aud_mode_t  *audio_mode_info;
-       audio_mode_item_t *audio_mode_item_info;
-};
 
 #endif