Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 32569ef7 authored by Hansong Zhang's avatar Hansong Zhang Committed by android-build-team Robot
Browse files

Fix OOB read in avrc_ctrl_pars_vendor_rsp 

Bug: 78526423
Test: manual
Change-Id: I0eeacc6a25b12f4b999098375d0d032cfa462a91
(cherry picked from commit 627574cb)
parent 38d45cfc

system/stack/avrc/avrc_pars_ct.cc

+5 −0
Original line number Original line Diff line number Diff line
@@ -479,6 +479,11 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg, 
        break;

        break;

      }

      }

      BE_STREAM_TO_UINT8(p_result->list_app_values.num_val, p);

      BE_STREAM_TO_UINT8(p_result->list_app_values.num_val, p);

      if (p_result->list_app_values.num_val > AVRC_MAX_APP_ATTR_SIZE) {

        android_errorWriteLog(0x534e4554, "78526423");

        p_result->list_app_values.num_val = AVRC_MAX_APP_ATTR_SIZE;

      }



      AVRC_TRACE_DEBUG("%s value count = %d ", __func__,

      AVRC_TRACE_DEBUG("%s value count = %d ", __func__,

                       p_result->list_app_values.num_val);

                       p_result->list_app_values.num_val);

      for (int xx = 0; xx < p_result->list_app_values.num_val; xx++) {

      for (int xx = 0; xx < p_result->list_app_values.num_val; xx++) {