From 4ae6135d13a94f61a567a99f5a42bb3c81cb3605 Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Mon, 3 Jun 2013 10:55:53 +0700 Subject: [PATCH] AVRCP: Fix crash when registering unsupported notification Reject command if notification is not supported otherwise this can cause crashes. --- profiles/audio/avrcp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c index 45584074a..89ba58c41 100644 --- a/profiles/audio/avrcp.c +++ b/profiles/audio/avrcp.c @@ -1358,6 +1358,10 @@ static uint8_t avrcp_handle_register_notification(struct avrcp *session, if (len != 5) goto err; + /* Check if event is supported otherwise reject */ + if (!(session->supported_events & (1 << pdu->params[0]))) + goto err; + switch (pdu->params[0]) { case AVRCP_EVENT_STATUS_CHANGED: len = 2; -- 2.47.3