Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ef5034c authored by Chienyuan's avatar Chienyuan Committed by android-build-merger
Browse files

Merge "Check packet length in bta_av_proc_meta_cmd" into oc-dev am: 02f8d339 

am: dcffc7bb

Change-Id: Ied0904860f58347e9cc5cf96ab486c0fce75443d
parents 46ee7dd8 dcffc7bb

system/bta/av/bta_av_act.cc

+7 −1
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ 
#include "bta_av_api.h"

#include "bta_av_int.h"

#include "l2c_api.h"

#include "log/log.h"

#include "osi/include/list.h"

#include "osi/include/log.h"

#include "osi/include/osi.h"
@@ -775,11 +776,16 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE* p_rc_rsp, 
      case AVRC_PDU_GET_CAPABILITIES:

        /* process GetCapabilities command without reporting the event to app */

        evt = 0;

        if (p_vendor->vendor_len != 5) {

          android_errorWriteLog(0x534e4554, "111893951");

          p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

          break;

        }

        u8 = *(p_vendor->p_vendor_data + 4);

        p = p_vendor->p_vendor_data + 2;

        p_rc_rsp->get_caps.capability_id = u8;

        BE_STREAM_TO_UINT16(u16, p);

        if ((u16 != 1) || (p_vendor->vendor_len != 5)) {

        if (u16 != 1) {

          p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

        } else {

          p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;