DO NOT MERGE: AVRCP: Check number of text attribute values in response

[android-x86/system-bt.git] / stack / avrc / avrc_pars_ct.c

diff --git a/stack/avrc/avrc_pars_ct.c b/stack/avrc/avrc_pars_ct.c
index 80c5c7d..b665b8d 100644 (file)
--- a/stack/avrc/avrc_pars_ct.c
+++ b/stack/avrc/avrc_pars_ct.c
@@ -265,6 +265,13 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
         tAVRC_APP_SETTING *app_sett =
             (tAVRC_APP_SETTING*)osi_malloc(p_result->get_cur_app_val.num_val*sizeof(tAVRC_APP_SETTING));
         AVRC_TRACE_DEBUG("%s attr count = %d ", __func__, p_result->get_cur_app_val.num_val);
+
+
+        if (p_result->get_cur_app_val.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+            android_errorWriteLog(0x534e4554, "63146237");
+            p_result->get_cur_app_val.num_val = AVRC_MAX_APP_ATTR_SIZE;
+        }
+
         for (int xx = 0; xx < p_result->get_cur_app_val.num_val; xx++)
         {
             BE_STREAM_TO_UINT8(app_sett[xx].attr_id, p);