Diff between 23f5b907fa69474cbb1c5fe94510b482b3e97543 and e2db62ab06e9a31d22121bb7765b7823dc3492b5
Changed Files
| File | Additions | Deletions | Status |
| android/avrcp-lib.c | +8 | -0 | modified |
Full Patch
diff --git a/android/avrcp-lib.c b/android/avrcp-lib.c
index 60d6e97..a490d76 100644
--- a/android/avrcp-lib.c
+++ b/android/avrcp-lib.c
@@ -1779,6 +1779,11 @@ static gboolean register_notification_rsp(struct avctp *conn,
rsp = (void *) pdu->params;
event = rsp->event;
+ if (event > AVRCP_EVENT_LAST) {
+ err = -EPROTO;
+ goto done;
+ }
+
switch (event) {
case AVRCP_EVENT_STATUS_CHANGED:
case AVRCP_EVENT_VOLUME_CHANGED:
@@ -1843,6 +1848,9 @@ int avrcp_register_notification(struct avrcp *session, uint8_t event,
struct iovec iov;
struct register_notification_req req;
+ if (event > AVRCP_EVENT_LAST)
+ return -EINVAL;
+
req.event = event;
put_be32(interval, &req.interval);