Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6011a01f authored by William Escande's avatar William Escande Committed by Automerger Merge Worker
Browse files

Merge "Check Avrcp packet vendor length before extracting length" into tm-dev am: 969c5b15 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/18105408



Change-Id: Ib62bdccd9918d6906f84bb7889590f233f78f589
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 37e6382c 969c5b15

system/stack/avrc/avrc_pars_tg.cc

+6 −0
Original line number Original line Diff line number Diff line
@@ -43,6 +43,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg, 
                                           tAVRC_COMMAND* p_result) {

                                           tAVRC_COMMAND* p_result) {

  tAVRC_STS status = AVRC_STS_NO_ERROR;

  tAVRC_STS status = AVRC_STS_NO_ERROR;





  if (p_msg->vendor_len < 4) {  // 4 == pdu + reserved byte + len as uint16

    AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",

                       __func__, p_msg->vendor_len);

    android_errorWriteLog(0x534e4554, "205571133");

    return AVRC_STS_INTERNAL_ERR;

  }

  uint8_t* p = p_msg->p_vendor_data;

  uint8_t* p = p_msg->p_vendor_data;

  p_result->pdu = *p++;

  p_result->pdu = *p++;

  AVRC_TRACE_DEBUG("%s pdu:0x%x", __func__, p_result->pdu);

  AVRC_TRACE_DEBUG("%s pdu:0x%x", __func__, p_result->pdu);