bluetooth: Validate data, ptr[5] and ptr[6] after calloc
@@ -1003,6 +1003,8 @@ static int __bt_convert_string_to_uuid(const char *string,
unsigned int val0, val4;
unsigned short val1, val2, val3, val5;
data = calloc(1, sizeof(char) * 16);
+ if (data == NULL)
+ return BT_ERROR_OUT_OF_MEMORY;
/* UUID format : %08x-%04hx-%04hx-%04hx-%08x%04hx */
strncpy(str_ptr, string, 36);
@@ -1017,6 +1019,9 @@ static int __bt_convert_string_to_uuid(const char *string,
/* ptr[4] contain "08x" and "04hx" */
ptr[5] = calloc(1, sizeof(char) * 8);
ptr[6] = calloc(1, sizeof(char) * 4);
+ if (ptr[5] == NULL || ptr[6] == NULL)
+ return BT_ERROR_OUT_OF_MEMORY;
+
strncpy(ptr[5], ptr[4], 8);
strncpy(ptr[6], ptr[4] + 8, 4);
