Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8a448b4 authored by William Escande's avatar William Escande Committed by Automerger Merge Worker
Browse files

Merge "Check Avrcp packet vendor length before extracting length" into tm-dev... 

Merge "Check Avrcp packet vendor length before extracting length" into tm-dev am: 969c5b15 am: 6011a01f

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/18105408



Change-Id: I4e1ba0a8e5b449819d764b44e3db50e522ee300d
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 56d47e16 6011a01f

system/stack/avrc/avrc_pars_tg.cc

+6 −0
Original line number Diff line number Diff line
@@ -43,6 +43,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg, 
                                           tAVRC_COMMAND* p_result) {

  tAVRC_STS status = AVRC_STS_NO_ERROR;



  if (p_msg->vendor_len < 4) {  // 4 == pdu + reserved byte + len as uint16

    AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",

                       __func__, p_msg->vendor_len);

    android_errorWriteLog(0x534e4554, "205571133");

    return AVRC_STS_INTERNAL_ERR;

  }

  uint8_t* p = p_msg->p_vendor_data;

  p_result->pdu = *p++;

  AVRC_TRACE_DEBUG("%s pdu:0x%x", __func__, p_result->pdu);