Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aaf3fead authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in bta_av_proc_meta_cmd 

Bug: 260726311
Test: manual
Ignore-AOSP-First: security
Tag: #security
Change-Id: I199fdd0651ebc29f130ebb5f5fa07e13f22a7d37
parent c2166e96

system/bta/av/bta_av_act.cc

+7 −0
Original line number Diff line number Diff line
@@ -758,6 +758,13 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE* p_rc_rsp, 
  uint16_t u16;

  tAVRC_MSG_VENDOR* p_vendor = &p_msg->msg.vendor;



  if (p_vendor->vendor_len == 0) {

    p_rc_rsp->rsp.status = AVRC_STS_BAD_PARAM;

    APPL_TRACE_DEBUG("%s: p_vendor->vendor_len == 0", __func__);

    // the caller of this function assume 0 to be an invalid event

    return 0;

  }



  pdu = *(p_vendor->p_vendor_data);

  p_rc_rsp->pdu = pdu;

  *p_ctype = AVRC_RSP_REJ;