Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 50b85db0 authored by Chienyuan's avatar Chienyuan
Browse files

DO NOT MERGE Check packet length in bta_av_proc_meta_cmd 

Bug: 111893951
Test: manual
Change-Id: Ie562c393e949c275203617972d43bb005190b32b
parent 88883058

system/bta/av/bta_av_act.c

+8 −1
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
#include "bta_av_api.h"

#include "bta_av_int.h"

#include "l2c_api.h"

#include "log/log.h"

#include "osi/include/list.h"

#include "osi/include/log.h"

#include "osi/include/osi.h"
@@ -800,11 +801,17 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE *p_rc_rsp, tBTA_AV_RC_MSG *p_ms 
        case AVRC_PDU_GET_CAPABILITIES:

            /* process GetCapabilities command without reporting the event to app */

            evt = 0;

            if (p_vendor->vendor_len != 5)

            {

                android_errorWriteLog(0x534e4554, "111893951");

                p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

                break;

            }

            u8 = *(p_vendor->p_vendor_data + 4);

            p = p_vendor->p_vendor_data + 2;

            p_rc_rsp->get_caps.capability_id = u8;

            BE_STREAM_TO_UINT16 (u16, p);

            if ((u16 != 1) || (p_vendor->vendor_len != 5))

            if (u16 != 1)

            {

                p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

            }