commit 585148802b62edd5bba5b7259ffff7a2b1e13a03
author Ajay Panicker <apanicke@google.com> Fri Feb 09 00:21:06 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Feb 16 22:51:50 2018 +0000
tree 5b2dc84efa0108ca6a515fa9ffb3218b1f3d413d
parent 82aac7454dd8f136845aef378fd1920f62035aa9

AVRCP: Set maximum string length when copying to buffer

Test: Compile
Bug: 71603262
Change-Id: I2416cdbcc3e4c5d71ab45998c02eb7cf679b1c10
(cherry picked from commit a3077fa62c2fc1c6be3a3dd1ecda1eb64472f36f)

stack/avrc/avrc_pars_tg.cc

diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index 99d3c7b..12b7598 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -497,8 +497,11 @@
       BE_STREAM_TO_UINT16(p_result->search.string.str_len, p);
       p_result->search.string.p_str = p_buf;
       if (p_buf) {
-        if (buf_len > p_result->search.string.str_len)
-          buf_len = p_result->search.string.str_len;
+        if (p_result->search.string.str_len > buf_len) {
+          p_result->search.string.str_len = buf_len;
+        } else {
+          android_errorWriteLog(0x534e4554, "63146237");
+        }
         BE_STREAM_TO_ARRAY(p, p_buf, p_result->search.string.str_len);
       } else {
         status = AVRC_STS_INTERNAL_ERR;