DO NOT MERGE: Check number of attributes before writing to a buffer

Bug: 73824150
Test: Compile
Change-Id: Ie38ba177d6599afe28b5c6684bd951a75fa8a805
(cherry picked from commit d28e985241e4efdf6f3ce7d665fe50f48be13dae)

diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index 6572fd7..28a2499 100644 (file)
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -47,6 +47,7 @@
 #include "osi/include/list.h"
 #include "osi/include/properties.h"
 #include "btu.h"
+#include "log/log.h"
 #define RC_INVALID_TRACK_ID (0xFFFFFFFFFFFFFFFFULL)
 
 /*****************************************************************************
@@ -2764,6 +2765,12 @@ static void handle_app_cur_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_
     bdcpy(rc_addr.address, btif_rc_cb.rc_addr);
 
     app_settings.num_attr = p_rsp->num_val;
+
+    if (app_settings.num_attr > BTRC_MAX_APP_SETTINGS) {
+        android_errorWriteLog(0x534e4554, "73824150");
+        app_settings.num_attr = BTRC_MAX_APP_SETTINGS;
+    }
+
     for (xx = 0; xx < app_settings.num_attr; xx++)
     {
         app_settings.attr_ids[xx] = p_rsp->p_vals[xx].attr_id;