Reject element attribute request if count is 0xff

Updates from review. BTRC_MAX_ELEM_ATTR_SIZE set back to 7 and handled
invalid attribute count (oxff) in BTIF

Change-Id: Id2610c7882c4bc8aca04491d81b9b2c35f0682d0

diff --git a/bta/av/bta_av_cfg.c b/bta/av/bta_av_cfg.c
index 604f0a5..1aeb2d6 100755 (executable)
--- a/bta/av/bta_av_cfg.c
+++ b/bta/av/bta_av_cfg.c
@@ -91,11 +91,10 @@ const tBTA_AV_CFG bta_av_cfg =
     AVRC_CO_BROADCOM,       /* AVRCP Company ID */
 #if AVRC_METADATA_INCLUDED == TRUE
     512,                    /* AVRCP MTU at L2CAP for control channel */
-    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */
 #else
     48,                     /* AVRCP MTU at L2CAP for control channel */
-    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */
 #endif
+    BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */
     BTA_AV_RC_SUPF_CT,      /* AVRCP controller categories */
     BTA_AV_RC_SUPF_TG,      /* AVRCP target categories */
     672,                    /* AVDTP signaling channel MTU at L2CAP */

diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index f1a2029..c55007a 100755 (executable)
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -838,21 +838,23 @@ static void btif_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8
         {
             btrc_media_attr_t element_attrs[BTRC_MAX_ELEM_ATTR_SIZE];
             UINT8 num_attr;
-             memset(&element_attrs, 0, sizeof(btrc_media_attr_t)*(BTRC_MAX_ELEM_ATTR_SIZE-1));
+             memset(&element_attrs, 0, sizeof(element_attrs));
             if (pavrc_cmd->get_elem_attrs.num_attr == 0)
             {
                 /* CT requests for all attributes */
                 int attr_cnt;
-                num_attr = (BTRC_MAX_ELEM_ATTR_SIZE - 1);
-                 for (attr_cnt = 1; attr_cnt < BTRC_MAX_ELEM_ATTR_SIZE; attr_cnt++)
+                num_attr = BTRC_MAX_ELEM_ATTR_SIZE;
+                for (attr_cnt = 0; attr_cnt < BTRC_MAX_ELEM_ATTR_SIZE; attr_cnt++)
                 {
-                    element_attrs[attr_cnt-1] = attr_cnt;
+                    element_attrs[attr_cnt] = attr_cnt + 1;
                 }
             }
             else if (pavrc_cmd->get_elem_attrs.num_attr == 0xFF)
             {
-                /* 0xff indicates, no attributes requested */
-                num_attr = 0;
+                /* 0xff indicates, no attributes requested - reject */
+                send_reject_response (btif_rc_cb.rc_handle, label, pavrc_cmd->pdu,
+                    AVRC_STS_BAD_PARAM);
+                return;
             }
             else
             {