Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dcffc7bb authored by Chienyuan's avatar Chienyuan Committed by android-build-merger
Browse files

Merge "Check packet length in bta_av_proc_meta_cmd" into oc-dev 

am: 02f8d339

Change-Id: I95920813d302cc3c363b3339189292efc79d7596
parents 6d2d00b6 02f8d339

system/bta/av/bta_av_act.cc

+7 −1
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include "bta_av_api.h"

#include "bta_av_int.h"

#include "l2c_api.h"

#include "log/log.h"

#include "osi/include/list.h"

#include "osi/include/log.h"

#include "osi/include/osi.h"
@@ -776,11 +777,16 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE* p_rc_rsp, 
      case AVRC_PDU_GET_CAPABILITIES:

        /* process GetCapabilities command without reporting the event to app */

        evt = 0;

        if (p_vendor->vendor_len != 5) {

          android_errorWriteLog(0x534e4554, "111893951");

          p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

          break;

        }

        u8 = *(p_vendor->p_vendor_data + 4);

        p = p_vendor->p_vendor_data + 2;

        p_rc_rsp->get_caps.capability_id = u8;

        BE_STREAM_TO_UINT16(u16, p);

        if ((u16 != 1) || (p_vendor->vendor_len != 5)) {

        if (u16 != 1) {

          p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;

        } else {

          p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;