commit b9c3ba8e12202f7b51456680029fc315de5d61b8
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Feb 18 05:09:10 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Feb 18 05:09:10 2022 +0000
tree 55551e56c3ebcf636685a4ace0fa3bc0c28a5c1a
parent b9f45b869802cd77e35f30a47a539fec2b706a4d
parent 1c38c2c0e7b23ace1393fa56b48e80d8dfd5dd7d

Merge cherrypicks of [16630868] into rvc-platform-release.

Change-Id: I903d91dff9c5a6b19a2d6f336f9dc8b0f249c1b3

stack/avrc/avrc_pars_ct.cc

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 08ab66e..8a4cf30 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -581,6 +581,10 @@
                        p_result->get_caps.capability_id,
                        p_result->get_caps.count);
       if (p_result->get_caps.capability_id == AVRC_CAP_COMPANY_ID) {
+        if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_COMP_ID) {
+          android_errorWriteLog(0x534e4554, "205837191");
+          return AVRC_STS_INTERNAL_ERR;
+        }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_COMP_ID) * 3;
         if (len < min_len) goto length_error;
         for (int xx = 0; ((xx < p_result->get_caps.count) &&
@@ -590,6 +594,10 @@
         }
       } else if (p_result->get_caps.capability_id ==
                  AVRC_CAP_EVENTS_SUPPORTED) {
+        if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_EVT_ID) {
+          android_errorWriteLog(0x534e4554, "205837191");
+          return AVRC_STS_INTERNAL_ERR;
+        }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_EVT_ID);
         if (len < min_len) goto length_error;
         for (int xx = 0; ((xx < p_result->get_caps.count) &&