commit 868e8fae0b66366b128ce199e64d55ff4c62709f
author Ajay Panicker <apanicke@google.com> Fri Feb 02 01:11:37 2018 -0800
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 13 14:09:54 2018 -0800
tree 985c44d8f2e3ca59520b1f4e2d979a9613f76e61
parent 9cc70aac50358b82f71a06c439f1bc7378d49af6

AVRCP: Check number of text attribute values in response

Test: Build
Bug: 71603410
Change-Id: I6f822b0bc7fc2fb042a70b64cff61583a86b36e2
(cherry picked from commit 4cd518cb3f8ac6ccb43c94a441bee67e041d0dd5)

stack/avrc/avrc_pars_ct.cc

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 7f7fe01..f302764 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -494,6 +494,12 @@
           p_result->get_cur_app_val.num_val * sizeof(tAVRC_APP_SETTING));
       AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,
                        p_result->get_cur_app_val.num_val);
+
+      if (p_result->get_cur_app_val.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+        android_errorWriteLog(0x534e4554, "63146237");
+        p_result->get_cur_app_val.num_val = AVRC_MAX_APP_ATTR_SIZE;
+      }
+
       for (int xx = 0; xx < p_result->get_cur_app_val.num_val; xx++) {
         BE_STREAM_TO_UINT8(app_sett[xx].attr_id, p);
         BE_STREAM_TO_UINT8(app_sett[xx].attr_val, p);