AVRCP: Reject when CT sends invalid RegisterNotification

Check whether the RegisterNotification request from CT is valid, and
safely reject invalid request

Bug: 111260441
Test: manually test with RIVA WAND speaker and run net_test_avrcp
Change-Id: Ia2edd94e50fa7cb5b61be54f297adf971060a924
Merged-In: Ia2edd94e50fa7cb5b61be54f297adf971060a924
(cherry picked from commit db61e462645d2787d5a05f6fa0d0fe9511523c0f)

diff --git a/packet/tests/avrcp/avrcp_test_packets.h b/packet/tests/avrcp/avrcp_test_packets.h
index e7e820b..bde1bd2 100644 (file)
--- a/packet/tests/avrcp/avrcp_test_packets.h
+++ b/packet/tests/avrcp/avrcp_test_packets.h
@@ -105,6 +105,10 @@ std::vector<uint8_t> register_volume_changed_notification = {
     0x03, 0x48, 0x00, 0x00, 0x19, 0x58, 0x31, 0x00,
     0x00, 0x05, 0x0d, 0x00, 0x00, 0x00, 0x00};
 
+// AVRCP Register Notification without any parameter
+std::vector<uint8_t> register_notification_invalid = {
+    0x03, 0x48, 0x00, 0x00, 0x19, 0x58, 0x31, 0x00, 0x00, 0x05};
+
 // AVRCP Interim Playback Status Notification
 std::vector<uint8_t> interim_play_status_notification = {
     0x0f, 0x48, 0x00, 0x00, 0x19, 0x58, 0x31, 0x00, 0x00, 0x02, 0x01, 0x00};

diff --git a/profile/avrcp/device.cc b/profile/avrcp/device.cc
index d2a985f..a834eaf 100644 (file)
--- a/profile/avrcp/device.cc
+++ b/profile/avrcp/device.cc
@@ -182,6 +182,14 @@ void Device::HandleGetCapabilities(
 
 void Device::HandleNotification(
     uint8_t label, const std::shared_ptr<RegisterNotificationRequest>& pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(ERROR) << __func__ << ": Request packet is not valid";
+    auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(),
+                                               Status::INVALID_PARAMETER);
+    send_message(label, false, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(4) << __func__ << ": event=" << pkt->GetEventRegistered();
 
   switch (pkt->GetEventRegistered()) {

diff --git a/profile/avrcp/tests/avrcp_device_test.cc b/profile/avrcp/tests/avrcp_device_test.cc
index d50644c..4a6dcb5 100644 (file)
--- a/profile/avrcp/tests/avrcp_device_test.cc
+++ b/profile/avrcp/tests/avrcp_device_test.cc
@@ -1031,6 +1031,22 @@ TEST_F(AvrcpDeviceTest, getInvalidItemAttributesTest) {
   SendBrowseMessage(1, request);
 }
 
+TEST_F(AvrcpDeviceTest, invalidRegisterNotificationTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto reg_notif_rej_rsp = RejectBuilder::MakeBuilder(
+      CommandPdu::REGISTER_NOTIFICATION, Status::INVALID_PARAMETER);
+  EXPECT_CALL(response_cb,
+              Call(1, false, matchPacket(std::move(reg_notif_rej_rsp))))
+      .Times(1);
+
+  auto reg_notif_request = TestAvrcpPacket::Make(register_notification_invalid);
+  SendMessage(1, reg_notif_request);
+}
+
 }  // namespace avrcp
 }  // namespace bluetooth