diff options
| author | Jakub Pawlowski <jpawlowski@google.com> | 2020-09-22 21:14:20 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-09-22 21:14:20 +0000 |
| commit | a6d074922e48b44c44ea4aaa86b6cd1929cd4ef5 (patch) | |
| tree | 91f0ffeab35c0634443b243370fdc0d1352fa649 | |
| parent | ae8049033b36d7b7d691dd786bd5419eccc9f382 (diff) | |
| parent | 721e323b2265d7ea60a94b54354d2c0eb09eaa44 (diff) | |
| download | bt-a6d074922e48b44c44ea4aaa86b6cd1929cd4ef5.tar.gz | |
Merge "fix oob in avrc_ctrl_pars_vendor_cmd" into rvc-dev
| -rw-r--r-- | stack/avrc/avrc_pars_tg.cc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc index fe1db3dbc..f2396b45e 100644 --- a/stack/avrc/avrc_pars_tg.cc +++ b/stack/avrc/avrc_pars_tg.cc @@ -71,6 +71,8 @@ static tAVRC_STS avrc_ctrl_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg, break; } case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */ + if (len < 5) return AVRC_STS_INTERNAL_ERR; + BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p); BE_STREAM_TO_UINT32(p_result->reg_notif.param, p); break; |