From: Ajay Panicker <apanicke@google.com>
Date: Fri, 11 May 2018 18:47:31 +0000 (-0700)
Subject: DO NOT MERGE: Check number of attributes before writing to a buffer
X-Git-Tag: android-x86-9.0-r1~71^2^2^2^2^2~2^2^2^2^2^2
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=d28e985241e4efdf6f3ce7d665fe50f48be13dae;p=android-x86%2Fsystem-bt.git

DO NOT MERGE: Check number of attributes before writing to a buffer

Bug: 73824150
Test: Compile
Change-Id: Ie38ba177d6599afe28b5c6684bd951a75fa8a805
---

diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index 8805f4f60..b79832bd0 100644
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -47,6 +47,7 @@
 #include "osi/include/list.h"
 #include "osi/include/properties.h"
 #include "btu.h"
+#include "log/log.h"
 #define RC_INVALID_TRACK_ID (0xFFFFFFFFFFFFFFFFULL)
 
 /*****************************************************************************
@@ -2763,6 +2764,12 @@ static void handle_app_cur_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_
     bdcpy(rc_addr.address, btif_rc_cb.rc_addr);
 
     app_settings.num_attr = p_rsp->num_val;
+
+    if (app_settings.num_attr > BTRC_MAX_APP_SETTINGS) {
+        android_errorWriteLog(0x534e4554, "73824150");
+        app_settings.num_attr = BTRC_MAX_APP_SETTINGS;
+    }
+
     for (xx = 0; xx < app_settings.num_attr; xx++)
     {
         app_settings.attr_ids[xx] = p_rsp->p_vals[xx].attr_id;