Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4b4ea7b authored by Ravi Nagarajan's avatar Ravi Nagarajan Committed by Android Git Automerger
Browse files

am c7628ae1: Reject element attribute request if count is 0xff 

* commit 'c7628ae1':
  Reject element attribute request if count is 0xff
parents 435f16d6 c7628ae1

system/bta/av/bta_av_cfg.c

+1 −2
Original line number Diff line number Diff line
@@ -91,11 +91,10 @@ const tBTA_AV_CFG bta_av_cfg = 
    AVRC_CO_BROADCOM,       /* AVRCP Company ID */

#if AVRC_METADATA_INCLUDED == TRUE

    512,                    /* AVRCP MTU at L2CAP for control channel */

    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */

#else

    48,                     /* AVRCP MTU at L2CAP for control channel */

    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */

#endif

    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */

    BTA_AV_RC_SUPF_CT,      /* AVRCP controller categories */

    BTA_AV_RC_SUPF_TG,      /* AVRCP target categories */

    672,                    /* AVDTP signaling channel MTU at L2CAP */

system/btif/src/btif_rc.c

+8 −6
Original line number Diff line number Diff line
@@ -838,21 +838,23 @@ static void btif_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8 
        {

            btrc_media_attr_t element_attrs[BTRC_MAX_ELEM_ATTR_SIZE];

            UINT8 num_attr;

             memset(&element_attrs, 0, sizeof(btrc_media_attr_t)*(BTRC_MAX_ELEM_ATTR_SIZE-1));

             memset(&element_attrs, 0, sizeof(element_attrs));

            if (pavrc_cmd->get_elem_attrs.num_attr == 0)

            {

                /* CT requests for all attributes */

                int attr_cnt;

                num_attr = (BTRC_MAX_ELEM_ATTR_SIZE - 1);

                 for (attr_cnt = 1; attr_cnt < BTRC_MAX_ELEM_ATTR_SIZE; attr_cnt++)

                num_attr = BTRC_MAX_ELEM_ATTR_SIZE;

                for (attr_cnt = 0; attr_cnt < BTRC_MAX_ELEM_ATTR_SIZE; attr_cnt++)

                {

                    element_attrs[attr_cnt-1] = attr_cnt;

                    element_attrs[attr_cnt] = attr_cnt + 1;

                }

            }

            else if (pavrc_cmd->get_elem_attrs.num_attr == 0xFF)

            {

                /* 0xff indicates, no attributes requested */

                num_attr = 0;

                /* 0xff indicates, no attributes requested - reject */

                send_reject_response (btif_rc_cb.rc_handle, label, pavrc_cmd->pdu,

                    AVRC_STS_BAD_PARAM);

                return;

            }

            else

            {