commit 478f53dd9726fed47e54187958ee86e40d1db240
author Ajay Panicker <apanicke@google.com> Fri Feb 02 00:56:43 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Feb 16 22:51:44 2018 +0000
tree 36e12e6b1b5c28872717ee2ac2f6b9af2b1d30e2
parent 6df0431c2c525221b80621dffc666c433acacb8d

AVRCP: Check number of text attributes in response

Test: Build
Bug: 71603315
Change-Id: Ieda5e410057062533ae09bd977bfe7f758a55140
(cherry picked from commit 658fd1b7c4ee959e42c20a2f1cfb7d895f94f6d2)

stack/avrc/avrc_pars_ct.cc

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 144c778..7f7fe01 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -22,6 +22,7 @@
 #include "avrc_int.h"
 #include "bt_common.h"
 #include "bt_utils.h"
+#include "log/log.h"
 #include "osi/include/osi.h"
 
 /*****************************************************************************
@@ -459,6 +460,12 @@
       BE_STREAM_TO_UINT8(p_result->list_app_attr.num_attr, p);
       AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,
                        p_result->list_app_attr.num_attr);
+
+      if (p_result->list_app_attr.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
+        android_errorWriteLog(0x534e4554, "63146237");
+        p_result->list_app_attr.num_attr = AVRC_MAX_APP_ATTR_SIZE;
+      }
+
       for (int xx = 0; xx < p_result->list_app_attr.num_attr; xx++) {
         BE_STREAM_TO_UINT8(p_result->list_app_attr.attrs[xx], p);
       }