Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78e1771d authored by Ajay Panicker's avatar Ajay Panicker Committed by Myles Watson
Browse files

AVRCP: Check number of text attribute values in response 

Test: Build
Bug: 71603410
Change-Id: I6f822b0bc7fc2fb042a70b64cff61583a86b36e2
parent e11cfb8d

system/stack/avrc/avrc_pars_ct.cc

+7 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include "avrc_int.h"

#include "bt_common.h"

#include "bt_utils.h"

#include "log/log.h"

#include "osi/include/osi.h"



/*****************************************************************************
@@ -487,6 +488,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg, 
          p_result->get_cur_app_val.num_val * sizeof(tAVRC_APP_SETTING));

      AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,

                       p_result->get_cur_app_val.num_val);



      if (p_result->get_cur_app_val.num_val > AVRC_MAX_APP_ATTR_SIZE) {

        android_errorWriteLog(0x534e4554, "63146237");

        p_result->get_cur_app_val.num_val = AVRC_MAX_APP_ATTR_SIZE;

      }



      for (int xx = 0; xx < p_result->get_cur_app_val.num_val; xx++) {

        BE_STREAM_TO_UINT8(app_sett[xx].attr_id, p);

        BE_STREAM_TO_UINT8(app_sett[xx].attr_val, p);