From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Mon, 3 Jun 2013 03:55:53 +0000 (+0700)
Subject: AVRCP: Fix crash when registering unsupported notification
X-Git-Tag: android-x86-4.4-r3~8013
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=4ae6135d13a94f61a567a99f5a42bb3c81cb3605;p=android-x86%2Fexternal-bluetooth-bluez.git

AVRCP: Fix crash when registering unsupported notification

Reject command if notification is not supported otherwise this can
cause crashes.
---

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 45584074a..89ba58c41 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -1358,6 +1358,10 @@ static uint8_t avrcp_handle_register_notification(struct avrcp *session,
 	if (len != 5)
 		goto err;
 
+	/* Check if event is supported otherwise reject */
+	if (!(session->supported_events & (1 << pdu->params[0])))
+		goto err;
+
 	switch (pdu->params[0]) {
 	case AVRCP_EVENT_STATUS_CHANGED:
 		len = 2;