Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c957ca39 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge changes from topic "am-49bd153a-ceb2-41b6-8588-4e6a6475d94a" into cw-f-dev 

* changes:
  [automerger] DO NOT MERGE Fix OOB read in avrc_ctrl_pars_vendor_rsp am: e8f2311e am: 2c0640a7 am: 944ed718
  [automerger] DO NOT MERGE Fix OOB read in avrc_ctrl_pars_vendor_rsp am: e8f2311e am: 2c0640a7
  [automerger] DO NOT MERGE Fix OOB read in avrc_ctrl_pars_vendor_rsp am: e8f2311e
  DO NOT MERGE Fix OOB read in avrc_ctrl_pars_vendor_rsp
parents 5c1c193c bf2a7431

system/stack/avrc/avrc_pars_ct.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -251,6 +251,11 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp( 
            break;

            break;

        }

        }

        BE_STREAM_TO_UINT8(p_result->list_app_values.num_val, p);

        BE_STREAM_TO_UINT8(p_result->list_app_values.num_val, p);

        if (p_result->list_app_values.num_val > AVRC_MAX_APP_ATTR_SIZE) {

            android_errorWriteLog(0x534e4554, "78526423");

            p_result->list_app_values.num_val = AVRC_MAX_APP_ATTR_SIZE;

        }



        AVRC_TRACE_DEBUG("%s value count = %d ", __func__, p_result->list_app_values.num_val);

        AVRC_TRACE_DEBUG("%s value count = %d ", __func__, p_result->list_app_values.num_val);

        for(int xx = 0; xx < p_result->list_app_values.num_val; xx++)

        for(int xx = 0; xx < p_result->list_app_values.num_val; xx++)

        {

        {