DO NOT MERGE AVRC: Add bound check for AVRC_EVT_APP_SETTING_CHANGE

Test: manual
Bug: 73782082
Change-Id: I4e384a2f8c0d8c4af03bd5865b2e907321419c86

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 3343624..fbfeeaf 100644 (file)
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -119,6 +119,10 @@ void avrc_parse_notification_rsp(uint8_t* p_stream,
 
     case AVRC_EVT_APP_SETTING_CHANGE:
       BE_STREAM_TO_UINT8(p_rsp->param.player_setting.num_attr, p_stream);
+      if (p_rsp->param.player_setting.num_attr > AVRC_MAX_APP_SETTINGS) {
+        android_errorWriteLog(0x534e4554, "73782082");
+        p_rsp->param.player_setting.num_attr = AVRC_MAX_APP_SETTINGS;
+      }
       for (int index = 0; index < p_rsp->param.player_setting.num_attr;
            index++) {
         BE_STREAM_TO_UINT8(p_rsp->param.player_setting.attr_id[index],