Avoid more annoying crashing

[android-x86/system-bt.git] / stack / avdt / avdt_msg.c

diff --git a/stack/avdt/avdt_msg.c b/stack/avdt/avdt_msg.c
index 636ef4b..9697a59 100644 (file)
--- a/stack/avdt/avdt_msg.c
+++ b/stack/avdt/avdt_msg.c
@@ -26,6 +26,7 @@
  *
  ******************************************************************************/
 
+#include <log/log.h>
 #include <string.h>
 #include "bt_types.h"
 #include "bt_target.h"
@@ -673,6 +674,11 @@ static UINT8 avdt_msg_prs_cfg(tAVDT_CFG *p_cfg, UINT8 *p, UINT16 len, UINT8* p_e
 
             case AVDT_CAT_PROTECT:
                 p_cfg->psc_mask &= ~AVDT_PSC_PROTECT;
+                if (p + elem_len > p_end) {
+                    err = AVDT_ERR_LENGTH;
+                    android_errorWriteLog(0x534e4554, "78288378");
+                    break;
+                }
                 if ((elem_len + protect_offset) < AVDT_PROTECT_SIZE)
                 {
                     p_cfg->num_protect++;
@@ -747,6 +753,11 @@ static UINT8 avdt_msg_prs_cfg(tAVDT_CFG *p_cfg, UINT8 *p, UINT16 len, UINT8* p_e
                 {
                     tmp = AVDT_CODEC_SIZE - 1;
                 }
+                if (p + tmp > p_end) {
+                    err = AVDT_ERR_LENGTH;
+                    android_errorWriteLog(0x534e4554, "78288378");
+                    break;
+                }
                 p_cfg->num_codec++;
                 p_cfg->codec_info[0] = elem_len;
                 memcpy(&p_cfg->codec_info[1], p, tmp);
@@ -1661,9 +1672,9 @@ void avdt_msg_send_grej(tAVDT_CCB *p_ccb, UINT8 sig_id, tAVDT_MSG *p_params)
     p_buf->len = (UINT16) (p - p_start);
 
     /* stash sig, label, and message type in buf */
-    p_buf->event = 0;
-    AVDT_BLD_LAYERSPEC(p_buf->layer_specific, 0, p_params->hdr.label);
-    AVDT_TRACE_DEBUG("avdt_msg_send_grej");
+    p_buf->event = sig_id;
+    AVDT_BLD_LAYERSPEC(p_buf->layer_specific, AVDT_MSG_TYPE_GRJ, p_params->hdr.label);
+    AVDT_TRACE_DEBUG(__func__);
 
     /* queue message and trigger ccb to send it */
     fixed_queue_enqueue(p_ccb->rsp_q, p_buf);