Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edd0a548 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Automerger Merge Worker
Browse files

Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am:... 

Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: 6f25ed78 am: a79fe0fd am: 511ebf1a am: a78c75be am: 2d2b5187 am: df8e0216

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/13490135

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ie453c02dc58e3e4bd40de456f7f3bd8f7b36d998
parents 819dcd34 df8e0216

system/stack/avrc/avrc_api.cc

+4 −3
Original line number Diff line number Diff line
@@ -633,9 +633,10 @@ static void avrc_msg_cback(uint8_t handle, uint8_t label, uint8_t cr, 
  tAVRC_MSG_VENDOR* p_msg = &msg.vendor;



  if (cr == AVCT_CMD && (p_pkt->layer_specific & AVCT_DATA_CTRL &&

                         AVRC_PACKET_LEN < sizeof(p_pkt->len))) {

    /* Ignore the invalid AV/C command frame */

    p_drop_msg = "dropped - too long AV/C cmd frame size";

                         p_pkt->len > AVRC_PACKET_LEN)) {

    android_errorWriteLog(0x534e4554, "177611958");

    AVRC_TRACE_WARNING("%s: Command length %d too long: must be at most %d",

                       __func__, p_pkt->len, AVRC_PACKET_LEN);

    osi_free(p_pkt);

    return;

  }