AVRCP: Fix crash when registering unsupported notification

Reject command if notification is not supported otherwise this can
cause crashes.

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 4558407..89ba58c 100644 (file)
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -1358,6 +1358,10 @@ static uint8_t avrcp_handle_register_notification(struct avrcp *session,
        if (len != 5)
                goto err;
 
+       /* Check if event is supported otherwise reject */
+       if (!(session->supported_events & (1 << pdu->params[0])))
+               goto err;
+
        switch (pdu->params[0]) {
        case AVRCP_EVENT_STATUS_CHANGED:
                len = 2;