diff options
| author | Ajay Panicker <apanicke@google.com> | 2018-02-09 00:21:06 -0800 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-02-14 17:18:01 +0000 |
| commit | 6f3ddf3f5cf2b3eb52fb0adabd814a45cff07221 (patch) | |
| tree | 5b2dc84efa0108ca6a515fa9ffb3218b1f3d413d | |
| parent | 1696f97011f5f30f1a630f3b24442ca64232b1f5 (diff) | |
| download | bt-6f3ddf3f5cf2b3eb52fb0adabd814a45cff07221.tar.gz | |
AVRCP: Set maximum string length when copying to buffer
Test: Compile
Bug: 71603262
Change-Id: I2416cdbcc3e4c5d71ab45998c02eb7cf679b1c10
(cherry picked from commit a3077fa62c2fc1c6be3a3dd1ecda1eb64472f36f)
| -rw-r--r-- | stack/avrc/avrc_pars_tg.cc | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc index 99d3c7bfa..12b759897 100644 --- a/stack/avrc/avrc_pars_tg.cc +++ b/stack/avrc/avrc_pars_tg.cc @@ -497,8 +497,11 @@ static tAVRC_STS avrc_pars_browsing_cmd(tAVRC_MSG_BROWSE* p_msg, BE_STREAM_TO_UINT16(p_result->search.string.str_len, p); p_result->search.string.p_str = p_buf; if (p_buf) { - if (buf_len > p_result->search.string.str_len) - buf_len = p_result->search.string.str_len; + if (p_result->search.string.str_len > buf_len) { + p_result->search.string.str_len = buf_len; + } else { + android_errorWriteLog(0x534e4554, "63146237"); + } BE_STREAM_TO_ARRAY(p, p_buf, p_result->search.string.str_len); } else { status = AVRC_STS_INTERNAL_ERR; |