Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7628ae1 authored by Ravi Nagarajan's avatar Ravi Nagarajan Committed by Zhihai Xu
Browse files

Reject element attribute request if count is 0xff 

Updates from review. BTRC_MAX_ELEM_ATTR_SIZE set back to 7 and handled
invalid attribute count (oxff) in BTIF

Change-Id: Id2610c7882c4bc8aca04491d81b9b2c35f0682d0
parent 42eecbb5

system/bta/av/bta_av_cfg.c

+1 −2
Original line number Diff line number Diff line
@@ -91,11 +91,10 @@ const tBTA_AV_CFG bta_av_cfg = 
    AVRC_CO_BROADCOM,       /* AVRCP Company ID */

#if AVRC_METADATA_INCLUDED == TRUE

    512,                    /* AVRCP MTU at L2CAP for control channel */

    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */

#else

    48,                     /* AVRCP MTU at L2CAP for control channel */

    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */

#endif

    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */

    BTA_AV_RC_SUPF_CT,      /* AVRCP controller categories */

    BTA_AV_RC_SUPF_TG,      /* AVRCP target categories */

    672,                    /* AVDTP signaling channel MTU at L2CAP */

system/btif/src/btif_rc.c

+8 −6
Original line number Diff line number Diff line
@@ -838,21 +838,23 @@ static void btif_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8 
        {

            btrc_media_attr_t element_attrs[BTRC_MAX_ELEM_ATTR_SIZE];

            UINT8 num_attr;

             memset(&element_attrs, 0, sizeof(btrc_media_attr_t)*(BTRC_MAX_ELEM_ATTR_SIZE-1));

             memset(&element_attrs, 0, sizeof(element_attrs));

            if (pavrc_cmd->get_elem_attrs.num_attr == 0)

            {

                /* CT requests for all attributes */

                int attr_cnt;

                num_attr = (BTRC_MAX_ELEM_ATTR_SIZE - 1);

                 for (attr_cnt = 1; attr_cnt < BTRC_MAX_ELEM_ATTR_SIZE; attr_cnt++)

                num_attr = BTRC_MAX_ELEM_ATTR_SIZE;

                for (attr_cnt = 0; attr_cnt < BTRC_MAX_ELEM_ATTR_SIZE; attr_cnt++)

                {

                    element_attrs[attr_cnt-1] = attr_cnt;

                    element_attrs[attr_cnt] = attr_cnt + 1;

                }

            }

            else if (pavrc_cmd->get_elem_attrs.num_attr == 0xFF)

            {

                /* 0xff indicates, no attributes requested */

                num_attr = 0;

                /* 0xff indicates, no attributes requested - reject */

                send_reject_response (btif_rc_cb.rc_handle, label, pavrc_cmd->pdu,

                    AVRC_STS_BAD_PARAM);

                return;

            }

            else

            {