commit b6f5d06c4353bb1de118d0a7faa930b4f1308306
author Ajay Panicker <apanicke@google.com> Wed Jan 10 16:58:16 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Feb 16 22:12:28 2018 +0000
tree 9e07dec35fbba3c332ca9431e1c15f328e4ebf28
parent a29b07fc4d42c048b1e2601e3df735fb2b545c73

AVRCP: Check the number of text value attributes requested

Test: Builds
Bug: 69479009
Change-Id: I184ddfdb56c15c2b07d52a2624240738efb4d207
(cherry picked from commit 6313da35abc93fcfb783c68f2e02427df9928ecf)

stack/avrc/avrc_pars_tg.cc

diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index 1ed6963..99d3c7b 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -220,6 +220,11 @@
               p_result->get_app_val_txt.num_val)
             status = AVRC_STS_INTERNAL_ERR;
           else {
+            if (p_result->get_app_val_txt.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+              android_errorWriteLog(0x534e4554, "63146237");
+              p_result->get_app_val_txt.num_val = AVRC_MAX_APP_ATTR_SIZE;
+            }
+
             p_u8 = p_result->get_app_val_txt.vals;
             for (xx = 0; xx < p_result->get_app_val_txt.num_val; xx++) {
               p_u8[xx] = *p++;