fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write

This commit is contained in:
Jin Cheng
2025-12-19 16:52:31 +08:00
parent 33af3a0aa6
commit 1ba8aaaff8
@@ -242,7 +242,11 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
status = AVRC_STS_INTERNAL_ERR;
} else {
BE_STREAM_TO_UINT8 (p_result->reg_notif.event_id, p);
BE_STREAM_TO_UINT32 (p_result->reg_notif.param, p);
if (AVRC_IS_VALID_EVENT_ID(p_result->reg_notif.event_id)) {
BE_STREAM_TO_UINT32 (p_result->reg_notif.param, p);
} else {
status = AVRC_STS_BAD_PARAM;
}
}
break;