Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f57eea15 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Fix an OOB bug in bta_av_proc_meta_cmd" into tm-dev am: 77089c95 am: 19bb41bd 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22940765



Change-Id: I71961b99ac0cda28da09b87875052a370dba0b53
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c65515b1 19bb41bd

system/bta/av/bta_av_act.cc

+7 −0
Original line number Diff line number Diff line
@@ -764,6 +764,13 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE* p_rc_rsp, 
  uint16_t u16;

  tAVRC_MSG_VENDOR* p_vendor = &p_msg->msg.vendor;



  if (p_vendor->vendor_len == 0) {

    p_rc_rsp->rsp.status = AVRC_STS_BAD_PARAM;

    APPL_TRACE_DEBUG("%s: p_vendor->vendor_len == 0", __func__);

    // the caller of this function assume 0 to be an invalid event

    return 0;

  }



  pdu = *(p_vendor->p_vendor_data);

  p_rc_rsp->pdu = pdu;

  *p_ctype = AVRC_RSP_REJ;