Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 511ebf1a authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Automerger Merge Worker
Browse files

Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: 6f25ed78 am: a79fe0fd 

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/13490135

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I4cdb26816f81d622d9aed94f176a7cfd2360b1b8
parents 423b3a97 a79fe0fd

system/stack/avrc/avrc_api.cc

+4 −3
Original line number Diff line number Diff line
@@ -633,9 +633,10 @@ static void avrc_msg_cback(uint8_t handle, uint8_t label, uint8_t cr, 
  tAVRC_MSG_VENDOR* p_msg = &msg.vendor;



  if (cr == AVCT_CMD && (p_pkt->layer_specific & AVCT_DATA_CTRL &&

                         AVRC_PACKET_LEN < sizeof(p_pkt->len))) {

    /* Ignore the invalid AV/C command frame */

    p_drop_msg = "dropped - too long AV/C cmd frame size";

                         p_pkt->len > AVRC_PACKET_LEN)) {

    android_errorWriteLog(0x534e4554, "177611958");

    AVRC_TRACE_WARNING("%s: Command length %d too long: must be at most %d",

                       __func__, p_pkt->len, AVRC_PACKET_LEN);

    osi_free(p_pkt);

    return;

  }