commit 97eb2f9cfba4f38d64dffa0558f1c4c3aa91b4f8
author Hansong Zhang <hsz@google.com> Fri May 11 11:36:29 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri May 25 18:41:59 2018 +0000
tree 3e76b0e6c66d18c51669df16de131bb1807af90c
parent 605ebb3369b3f961196815065a9fe4ba5bc4d659

DO NOT MERGE AVRC: Add bound check for AVRC_EVT_APP_SETTING_CHANGE

Test: manual
Bug: 73782082
Change-Id: I4e384a2f8c0d8c4af03bd5865b2e907321419c86
(cherry picked from commit 0061dd6ae30ebcebce695c212c8bc0ceb276710e)

stack/avrc/avrc_pars_ct.cc

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 3343624..fbfeeaf 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -119,6 +119,10 @@
 
     case AVRC_EVT_APP_SETTING_CHANGE:
       BE_STREAM_TO_UINT8(p_rsp->param.player_setting.num_attr, p_stream);
+      if (p_rsp->param.player_setting.num_attr > AVRC_MAX_APP_SETTINGS) {
+        android_errorWriteLog(0x534e4554, "73782082");
+        p_rsp->param.player_setting.num_attr = AVRC_MAX_APP_SETTINGS;
+      }
       for (int index = 0; index < p_rsp->param.player_setting.num_attr;
            index++) {
         BE_STREAM_TO_UINT8(p_rsp->param.player_setting.attr_id[index],