commit 82aac7454dd8f136845aef378fd1920f62035aa9
author Ajay Panicker <apanicke@google.com> Fri Feb 02 01:26:34 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Feb 16 22:51:47 2018 +0000
tree 879194ec04c0c86e7291878232af22e027241516
parent 478f53dd9726fed47e54187958ee86e40d1db240

AVRCP: Initialize buffer for attribute values to be written to

Test: Build
Bug: 71603553
Change-Id: I978270605cfaa3b833d6c19f1b1d2cd5a82ac079
(cherry picked from commit e36d6f8edceed860929901b6c49c1964a1ac563f)

stack/avrc/avrc_pars_ct.cc

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 7f7fe01..82c3cd7 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -502,7 +502,6 @@
     } break;
 
     case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT: {
-      tAVRC_APP_SETTING_TEXT* p_setting_text;
       uint8_t num_attrs;
 
       if (len == 0) {
@@ -510,10 +509,14 @@
         break;
       }
       BE_STREAM_TO_UINT8(num_attrs, p);
+      if (num_attrs > AVRC_MAX_APP_ATTR_SIZE) {
+        num_attrs = AVRC_MAX_APP_ATTR_SIZE;
+      }
       AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,
                        p_result->get_app_attr_txt.num_attr);
       p_result->get_app_attr_txt.num_attr = num_attrs;
-      p_setting_text = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
+
+      p_result->get_app_attr_txt.p_attrs = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
           num_attrs * sizeof(tAVRC_APP_SETTING_TEXT));
       for (int xx = 0; xx < num_attrs; xx++) {
         BE_STREAM_TO_UINT8(p_result->get_app_attr_txt.p_attrs[xx].attr_id, p);
@@ -533,7 +536,6 @@
     } break;
 
     case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT: {
-      tAVRC_APP_SETTING_TEXT* p_setting_text;
       uint8_t num_vals;
 
       if (len == 0) {
@@ -541,11 +543,14 @@
         break;
       }
       BE_STREAM_TO_UINT8(num_vals, p);
+      if (num_vals > AVRC_MAX_APP_ATTR_SIZE) {
+        num_vals = AVRC_MAX_APP_ATTR_SIZE;
+      }
       p_result->get_app_val_txt.num_attr = num_vals;
       AVRC_TRACE_DEBUG("%s value count = %d ", __func__,
                        p_result->get_app_val_txt.num_attr);
 
-      p_setting_text = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
+      p_result->get_app_val_txt.p_attrs = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
           num_vals * sizeof(tAVRC_APP_SETTING_TEXT));
       for (int i = 0; i < num_vals; i++) {
         BE_STREAM_TO_UINT8(p_result->get_app_val_txt.p_attrs[i].attr_id, p);