commit 721e323b2265d7ea60a94b54354d2c0eb09eaa44
author Jakub Pawlowski <jpawlowski@google.com> Fri Sep 18 09:41:34 2020 +0200
committer Jakub Pawlowski <jpawlowski@google.com> Fri Sep 18 15:58:10 2020 +0000
tree 082659251f8ce614138f958338fb9495bc3de23b
parent 7aaf2edf90daa5513d651cadb9969e4d8e90ccc1

fix oob in avrc_ctrl_pars_vendor_cmd

Bug: 168712245
Test: compilation
Tag: #security
Change-Id: I7d26f9817b0ec8ff9a177271ea45cc9dd6701472

stack/avrc/avrc_pars_tg.cc

diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index fe1db3d..f2396b4 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -71,6 +71,8 @@
       break;
     }
     case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */
+      if (len < 5) return AVRC_STS_INTERNAL_ERR;
+
       BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
       BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);
       break;