Add validation on sdp attributes in bta_av_act.cc

Bug: 263958603
Test: atest bt_host_test_bta
Ignore-AOSP-First: security
Tag: #security
Change-Id: I5286fabf49f14cba5ef65a79d6e1eadb40bbb514

system/bta/av/bta_av_act.cc

@@ -1894,7 +1894,9 @@ tBTA_AV_FEAT bta_av_check_peer_features(uint16_t service_uuid) {
         /* get supported categories */
         p_attr = get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(
             p_rec, ATTR_ID_SUPPORTED_FEATURES);
-        if (p_attr != NULL) {
+        if (p_attr != NULL &&
+            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
+            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
           categories = p_attr->attr_value.v.u16;
           if (categories & AVRC_SUPF_CT_CAT2)
             peer_features |= (BTA_AV_FEAT_ADV_CTRL);
@@ -1960,7 +1962,9 @@ tBTA_AV_FEAT bta_avk_check_peer_features(uint16_t service_uuid) {
       tSDP_DISC_ATTR* p_attr =
           get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(
               p_rec, ATTR_ID_SUPPORTED_FEATURES);
-      if (p_attr != NULL) {
+      if (p_attr != NULL &&
+          SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
+          SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
         uint16_t categories = p_attr->attr_value.v.u16;
         /*
          * Though Absolute Volume came after in 1.4 and above, but there are