Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e6ca5d4 authored by Pavlin Radoslavov's avatar Pavlin Radoslavov
Browse files

Add an explicit check for AVRCP vendor data 

Add an explicit check for AVRCP vendor data when parsing received vendor
commands or responses.

Bug: 21768387
Change-Id: I715de6fc7348d063c448971a8dae6dd1b00c7062
parent 4b2932fb

system/stack/avrc/avrc_pars_ct.c

+8 −1
Original line number Diff line number Diff line
@@ -43,10 +43,17 @@ 
static tAVRC_STS avrc_pars_vendor_rsp(tAVRC_MSG_VENDOR *p_msg, tAVRC_RESPONSE *p_result)

{

    tAVRC_STS  status = AVRC_STS_NO_ERROR;

    UINT8   *p = p_msg->p_vendor_data;

    UINT8   *p;

    UINT16  len;

    UINT8 eventid=0;



    /* Check the vendor data */

    if (p_msg->vendor_len == 0)

        return AVRC_STS_NO_ERROR;

    if (p_msg->p_vendor_data == NULL)

        return AVRC_STS_INTERNAL_ERR;



    p = p_msg->p_vendor_data;

    BE_STREAM_TO_UINT8 (p_result->pdu, p);

    p++; /* skip the reserved/packe_type byte */

    BE_STREAM_TO_UINT16 (len, p);

system/stack/avrc/avrc_pars_tg.c

+8 −1
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_ 
                                      UINT8 *p_buf, UINT16 buf_len)

{

    tAVRC_STS  status = AVRC_STS_NO_ERROR;

    UINT8   *p = p_msg->p_vendor_data;

    UINT8   *p;

    UINT16  len;

    UINT8   xx, yy;

    UINT8   *p_u8;
@@ -51,6 +51,13 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_ 
    tAVRC_APP_SETTING       *p_app_set;

    UINT16  size_needed;



    /* Check the vendor data */

    if (p_msg->vendor_len == 0)

        return AVRC_STS_NO_ERROR;

    if (p_msg->p_vendor_data == NULL)

        return AVRC_STS_INTERNAL_ERR;



    p = p_msg->p_vendor_data;

    p_result->pdu = *p++;

    AVRC_TRACE_DEBUG("avrc_pars_vendor_cmd() pdu:0x%x", p_result->pdu);

    if (!AVRC_IsValidAvcType (p_result->pdu, p_msg->hdr.ctype))