Skip to content
Snippets Groups Projects
Commit 590aa47f authored by Hui Peng's avatar Hui Peng
Browse files

Add validation on sdp attributes in bta_av_act.cc

Bug: 263958603
Test: atest bt_host_test_bta
Ignore-AOSP-First: security
Tag: #security
Change-Id: I5286fabf49f14cba5ef65a79d6e1eadb40bbb514
parent 509feb84
No related branches found
No related tags found
No related merge requests found
......@@ -1894,7 +1894,9 @@ tBTA_AV_FEAT bta_av_check_peer_features(uint16_t service_uuid) {
/* get supported categories */
p_attr = get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(
p_rec, ATTR_ID_SUPPORTED_FEATURES);
if (p_attr != NULL) {
if (p_attr != NULL &&
SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
categories = p_attr->attr_value.v.u16;
if (categories & AVRC_SUPF_CT_CAT2)
peer_features |= (BTA_AV_FEAT_ADV_CTRL);
......@@ -1960,7 +1962,9 @@ tBTA_AV_FEAT bta_avk_check_peer_features(uint16_t service_uuid) {
tSDP_DISC_ATTR* p_attr =
get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(
p_rec, ATTR_ID_SUPPORTED_FEATURES);
if (p_attr != NULL) {
if (p_attr != NULL &&
SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
uint16_t categories = p_attr->attr_value.v.u16;
/*
* Though Absolute Volume came after in 1.4 and above, but there are
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment