DO NOT MERGE: AVRCP: Check the number of text attributes requested

Test: Build
Bug: 69478941
Change-Id: Ic7e2632e5dab9031703b2bf8747e27f90f92f0e4
(cherry picked from commit 1661401e3a7b535f4c7eccfc15e4f228bf385eea)

diff --git a/stack/avrc/avrc_pars_tg.c b/stack/avrc/avrc_pars_tg.c
index 3f3fe93..b62ec60 100644 (file)
--- a/stack/avrc/avrc_pars_tg.c
+++ b/stack/avrc/avrc_pars_tg.c
@@ -21,6 +21,7 @@
 #include "avrc_api.h"
 #include "avrc_defs.h"
 #include "avrc_int.h"
+#include "log/log.h"
 
 /*****************************************************************************
 **  Global data
@@ -169,6 +170,12 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
             status = AVRC_STS_INTERNAL_ERR;
             break;
         }
+
+        if (p_result->get_cur_app_val.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
+          android_errorWriteLog(0x534e4554, "63146237");
+          p_result->get_cur_app_val.num_attr = AVRC_MAX_APP_ATTR_SIZE;
+        }
+
         p_u8 = p_result->get_cur_app_val.attrs;
         for (xx=0, yy=0; xx< p_result->get_cur_app_val.num_attr; xx++)
         {