diff options
| author | Ajay Panicker <apanicke@google.com> | 2018-01-10 16:58:16 -0800 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2018-04-06 19:07:36 +0200 |
| commit | 96e84cff3f765f89fdea5041e6394b6dfb466b5d (patch) | |
| tree | 4e1418d3762be53e64f0a94bbd4f7014236fb5f8 | |
| parent | 9cbf5548726bdc284b529cb8a78c1a1e1a0103b3 (diff) | |
| download | android_system_bt-96e84cff3f765f89fdea5041e6394b6dfb466b5d.tar.gz android_system_bt-96e84cff3f765f89fdea5041e6394b6dfb466b5d.tar.bz2 android_system_bt-96e84cff3f765f89fdea5041e6394b6dfb466b5d.zip | |
AVRCP: Check the number of text value attributes requested
Test: Builds
Bug: 69479009
Change-Id: I184ddfdb56c15c2b07d52a2624240738efb4d207
(cherry picked from commit 6313da35abc93fcfb783c68f2e02427df9928ecf)
| -rw-r--r-- | stack/avrc/avrc_pars_tg.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/stack/avrc/avrc_pars_tg.c b/stack/avrc/avrc_pars_tg.c index dc6cb68cc..8f41d1235 100644 --- a/stack/avrc/avrc_pars_tg.c +++ b/stack/avrc/avrc_pars_tg.c @@ -237,6 +237,11 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_ status = AVRC_STS_INTERNAL_ERR; else { + if (p_result->get_app_val_txt.num_val > AVRC_MAX_APP_ATTR_SIZE) { + android_errorWriteLog(0x534e4554, "63146237"); + p_result->get_app_val_txt.num_val = AVRC_MAX_APP_ATTR_SIZE; + } + p_u8 = p_result->get_app_val_txt.vals; for (xx=0; xx< p_result->get_app_val_txt.num_val; xx++) { |