commit 3ddf24d80e33d2964f47b7e57ea821c52bca3232
author Ajay Panicker <apanicke@google.com> Wed Jan 10 16:12:50 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Thu Jan 18 22:43:51 2018 +0000
tree 02883b31fd0dc1d8dfa5f8757002aa6ae2366245
parent 971159847d786e6b398ad1c2243463227b07da2d

AVRCP: Check the number of text attributes requested

Test: Build
Bug: 69478941
Change-Id: Ibc456511c8d7339213f08b07d70f5e25be140d68
(cherry picked from commit 249bb665b1020e81547246f5b29ed9040d696388)

stack/avrc/avrc_pars_tg.cc

diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index cc5ec1d..1ed6963 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -21,6 +21,7 @@
 #include "avrc_defs.h"
 #include "avrc_int.h"
 #include "bt_common.h"
+#include "log/log.h"
 
 /*****************************************************************************
  *  Global data
@@ -158,6 +159,12 @@
         status = AVRC_STS_INTERNAL_ERR;
         break;
       }
+
+      if (p_result->get_cur_app_val.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
+        android_errorWriteLog(0x534e4554, "63146237");
+        p_result->get_cur_app_val.num_attr = AVRC_MAX_APP_ATTR_SIZE;
+      }
+
       p_u8 = p_result->get_cur_app_val.attrs;
       for (xx = 0, yy = 0; xx < p_result->get_cur_app_val.num_attr; xx++) {
         /* only report the valid player app attributes */