commit 5b4b79977d3e40b7407cf0d34515c7af60451d1b
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Feb 10 22:12:00 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Feb 10 22:12:00 2022 +0000
tree dc17900ce01e696c10f0a2e5ac60cf355b152e5a
parent e3157931147e9c2c378fe662ce213252f89df9dd
parent 8c6477c42e6ac76dc58b3732f50bc413af6e41a5

Merge cherrypicks of [16630869] into security-aosp-qt-release.

Change-Id: I1e3240b548a40602093389e3c8a5a7b514f6d425

stack/avrc/avrc_pars_ct.cc

diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 4692b0c..66ccee0 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -550,6 +550,10 @@
                        p_result->get_caps.capability_id,
                        p_result->get_caps.count);
       if (p_result->get_caps.capability_id == AVRC_CAP_COMPANY_ID) {
+        if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_COMP_ID) {
+          android_errorWriteLog(0x534e4554, "205837191");
+          return AVRC_STS_INTERNAL_ERR;
+        }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_COMP_ID) * 3;
         if (len < min_len) goto length_error;
         for (int xx = 0; ((xx < p_result->get_caps.count) &&
@@ -559,6 +563,10 @@
         }
       } else if (p_result->get_caps.capability_id ==
                  AVRC_CAP_EVENTS_SUPPORTED) {
+        if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_EVT_ID) {
+          android_errorWriteLog(0x534e4554, "205837191");
+          return AVRC_STS_INTERNAL_ERR;
+        }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_EVT_ID);
         if (len < min_len) goto length_error;
         for (int xx = 0; ((xx < p_result->get_caps.count) &&