From 0388794dc5fdb73a4ea88bcf148de0a12b4364d4 Mon Sep 17 00:00:00 2001
From: Archie Pusaka <apusaka@chromium.org>
Date: Thu, 17 Jun 2021 08:53:34 +0800
Subject: avdtp: Fix parsing capabilities

This patch fixes size comparison and variable misassignment.

Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Michael Sun <michaelfsun@google.com>
---
 profiles/audio/avdtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'profiles/audio/avdtp.c')

--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -1271,7 +1271,7 @@ static GSList *caps_to_list(uint8_t *dat
 
 		cap = (struct avdtp_service_capability *)data;
 
-		if (sizeof(*cap) + cap->length >= size) {
+		if (sizeof(*cap) + cap->length > size) {
 			error("Invalid capability data in getcap resp");
 			break;
 		}
@@ -1293,7 +1293,7 @@ static GSList *caps_to_list(uint8_t *dat
 		switch (cap->category) {
 		case AVDTP_MEDIA_CODEC:
 			if (codec)
-				*codec = cap;
+				*codec = cpy;
 			break;
 		case AVDTP_DELAY_REPORTING:
 			if (delay_reporting)