Diff between 23f5b907fa69474cbb1c5fe94510b482b3e97543 and e2db62ab06e9a31d22121bb7765b7823dc3492b5

Changed Files

File Additions Deletions Status
android/avrcp-lib.c +8 -0 modified

Full Patch

diff --git a/android/avrcp-lib.c b/android/avrcp-lib.c
index 60d6e97..a490d76 100644
--- a/android/avrcp-lib.c
+++ b/android/avrcp-lib.c
@@ -1779,6 +1779,11 @@ static gboolean register_notification_rsp(struct avctp *conn,
 	rsp = (void *) pdu->params;
 	event = rsp->event;
 
+	if (event > AVRCP_EVENT_LAST) {
+		err = -EPROTO;
+		goto done;
+	}
+
 	switch (event) {
 	case AVRCP_EVENT_STATUS_CHANGED:
 	case AVRCP_EVENT_VOLUME_CHANGED:
@@ -1843,6 +1848,9 @@ int avrcp_register_notification(struct avrcp *session, uint8_t event,
 	struct iovec iov;
 	struct register_notification_req req;
 
+	if (event > AVRCP_EVENT_LAST)
+		return -EINVAL;
+
 	req.event = event;
 	put_be32(interval, &req.interval);