diff --git a/system/stack/avrc/avrc_opt.cc b/system/stack/avrc/avrc_opt.cc index a611e3f5a7227369a2925ad653b6662eedc4aa16..87c685c2c495ab5c6c8e58f8183e378154b923f7 100644 --- a/system/stack/avrc/avrc_opt.cc +++ b/system/stack/avrc/avrc_opt.cc @@ -49,9 +49,20 @@ static BT_HDR* avrc_vendor_msg(tAVRC_MSG_VENDOR* p_msg) { BT_HDR* p_cmd; uint8_t* p_data; - CHECK(p_msg != NULL); + /* + An AVRC cmd consists of at least of: + - A BT_HDR, plus + - AVCT_MSG_OFFSET, plus + - 3 bytes for ctype, subunit_type and op_vendor, plus + - 3 bytes for company_id + */ + #define AVRC_MIN_VENDOR_CMD_LEN (sizeof(BT_HDR) + AVCT_MSG_OFFSET + 3 + 3) + + if (p_msg == nullptr || + AVRC_META_CMD_BUF_SIZE < AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len) { + return nullptr; + } - CHECK(AVRC_META_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->vendor_len)); p_cmd = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE); p_cmd->offset = AVCT_MSG_OFFSET;