Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8aa4adc authored by Chienyuan's avatar Chienyuan Committed by android-build-team Robot
Browse files

Check packet length in bta_av_proc_meta_cmd 

Bug: 111893951
Test: manual - connect A2DP
Change-Id: Ibbf347863dfd29ea3385312e9dde1082bc90d2f3
(cherry picked from commit 8b0ac171)
parent 32569ef7

system/bta/av/bta_av_act.cc

+7 −1
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
#include "bta_av_api.h"

#include "bta_av_int.h"

#include "l2c_api.h"

#include "log/log.h"

#include "osi/include/list.h"

#include "osi/include/log.h"

#include "osi/include/osi.h"
@@ -784,11 +785,16 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE* p_rc_rsp, 
      case AVRC_PDU_GET_CAPABILITIES:

        /* process GetCapabilities command without reporting the event to app */

        evt = 0;

        if (p_vendor->vendor_len != 5) {

          android_errorWriteLog(0x534e4554, "111893951");

          p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

          break;

        }

        u8 = *(p_vendor->p_vendor_data + 4);

        p = p_vendor->p_vendor_data + 2;

        p_rc_rsp->get_caps.capability_id = u8;

        BE_STREAM_TO_UINT16(u16, p);

        if ((u16 != 1) || (p_vendor->vendor_len != 5)) {

        if (u16 != 1) {

          p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

        } else {

          p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;