Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d9d9e5e authored by William Escande's avatar William Escande
Browse files

Check Avrcp packet vendor length before extracting length 

Bug: 205571133
Test: build + ag/18105403 for sts test
Ignore-AOSP-First: Security vulnerability
Change-Id: Ic9fa9400ab15785cfdb251af66b1867daf09570e
parent 89f4da04

system/stack/avrc/avrc_pars_tg.cc

+6 −0
Original line number Diff line number Diff line
@@ -43,6 +43,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg, 
                                           tAVRC_COMMAND* p_result) {

  tAVRC_STS status = AVRC_STS_NO_ERROR;



  if (p_msg->vendor_len < 4) {  // 4 == pdu + reserved byte + len as uint16

    AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",

                       __func__, p_msg->vendor_len);

    android_errorWriteLog(0x534e4554, "205571133");

    return AVRC_STS_INTERNAL_ERR;

  }

  uint8_t* p = p_msg->p_vendor_data;

  p_result->pdu = *p++;

  AVRC_TRACE_DEBUG("%s pdu:0x%x", __func__, p_result->pdu);