Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 68c15b87 authored by Jakub Pawlowski's avatar Jakub Pawlowski Committed by Myles Watson
Browse files

Make sure only valid packet fields are accessed in VendorPacketHandler 

Move packet validation above first access to GetEvent()

Bug: 144066833
Test: avrcp_device_fuzz
Change-Id: I62c03763e7e921adc3456c53090fbf30ff87946e
(cherry picked from commit c9a02d8b)
parent cc2233e7

system/profile/avrcp/device.cc

+13 −10
Original line number Diff line number Diff line
@@ -98,6 +98,19 @@ void Device::VendorPacketHandler(uint8_t label, 
      case CommandPdu::REGISTER_NOTIFICATION: {

        auto register_notification =

            Packet::Specialize<RegisterNotificationResponse>(pkt);



        if (!register_notification->IsValid()) {

          DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";

          auto response =

              RejectBuilder::MakeBuilder(pkt->GetCommandPdu(),

                                         Status::INVALID_PARAMETER);

          send_message(label, false, std::move(response));

          active_labels_.erase(label);

          volume_interface_ = nullptr;

          volume_ = VOL_REGISTRATION_FAILED;

          return;

        }



        if (register_notification->GetEvent() != Event::VOLUME_CHANGED) {

          DEVICE_LOG(WARNING)

              << __func__ << ": Unhandled register notification received: "
@@ -336,16 +349,6 @@ void Device::HandleVolumeChanged( 
    uint8_t label, const std::shared_ptr<RegisterNotificationResponse>& pkt) {

  DEVICE_VLOG(1) << __func__ << ": interim=" << pkt->IsInterim();



  if (!pkt->IsValid()) {

    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";

    auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);

    send_message(label, false, std::move(response));

    active_labels_.erase(label);

    volume_interface_ = nullptr;

    volume_ = VOL_REGISTRATION_FAILED;

    return;

  }



  if (volume_interface_ == nullptr) return;



  if (pkt->GetCType() == CType::REJECTED) {