commit 09a412ad9c46f45fbc31bd5e34936b54287d23d1
author Hansong Zhang <hsz@google.com> Fri Dec 11 12:33:50 2020 -0800
committer Hansong Zhang <hsz@google.com> Sat Dec 12 01:11:36 2020 +0000
tree b6956db8d6eec4efbca5dbdf810f4cf56e00d846
parent b2c309f2883c4afde71626ab756b5ac42c790dbb

AVRCP: Fix a counter

Change-Id: Ie711b02b6a2cd7a4c3cd85b1b1d078d6771e2a6a
Tag: #security
Bug: 174495119
Test: POC

system/profile/avrcp/avrcp_message_converter.h

diff --git a/system/profile/avrcp/avrcp_message_converter.h b/system/profile/avrcp/avrcp_message_converter.h
index 8de704b..5f5212a 100644
--- a/system/profile/avrcp/avrcp_message_converter.h
+++ b/system/profile/avrcp/avrcp_message_converter.h
@@ -76,7 +76,7 @@
         for (int i = 2; i >= 0; i--) {
           data.push_back((uint8_t)((msg->company_id >> i * 8) & 0xff));
         }
-        for (uint8_t i = 0; i < msg->vendor_len; i++) {
+        for (int i = 0; i < msg->vendor_len; i++) {
           data.push_back(msg->p_vendor_data[i]);
         }
       } break;
@@ -103,4 +103,4 @@
 
     return VectorPacket::Make(data);
   }
-};
\ No newline at end of file
+};