From 61c0946375922a5f1f1f0eefa838fcca36ab4beb Mon Sep 17 00:00:00 2001 From: Ajay Panicker Date: Wed, 10 Jan 2018 16:34:50 -0800 Subject: [PATCH] DO NOT MERGE: AVRCP: Check the number of text attributes requested Test: Build Bug: 69478941 Change-Id: Ic7e2632e5dab9031703b2bf8747e27f90f92f0e4 (cherry picked from commit 1661401e3a7b535f4c7eccfc15e4f228bf385eea) --- stack/avrc/avrc_pars_tg.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/stack/avrc/avrc_pars_tg.c b/stack/avrc/avrc_pars_tg.c index 3f3fe9385..b62ec6085 100644 --- a/stack/avrc/avrc_pars_tg.c +++ b/stack/avrc/avrc_pars_tg.c @@ -21,6 +21,7 @@ #include "avrc_api.h" #include "avrc_defs.h" #include "avrc_int.h" +#include "log/log.h" /***************************************************************************** ** Global data @@ -169,6 +170,12 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_ status = AVRC_STS_INTERNAL_ERR; break; } + + if (p_result->get_cur_app_val.num_attr > AVRC_MAX_APP_ATTR_SIZE) { + android_errorWriteLog(0x534e4554, "63146237"); + p_result->get_cur_app_val.num_attr = AVRC_MAX_APP_ATTR_SIZE; + } + p_u8 = p_result->get_cur_app_val.attrs; for (xx=0, yy=0; xx< p_result->get_cur_app_val.num_attr; xx++) { -- 2.11.0