Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt_avrcp): size some AVRC command buffers

Browse Source
This commit is contained in:
hejiaxin
2026-08-27 15:14:53 +08:00
parent 8ac6aa8aa0
commit 49bac9fbbf
2 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
components/bt/host/bluedroid/stack/avrc/avrc_api.c
View File

@@ -910,11 +910,19 @@ static BT_HDR *avrc_pass_msg(tAVRC_MSG_PASS *p_msg)
{
BT_HDR *p_cmd = NULL;
UINT8 *p_data;
UINT32 buf_size;
UINT16 pass_len;
assert(p_msg != NULL);
assert(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN+p_msg->pass_len));
if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) {
/* ctype(1) + subunit(1) + opcode(1) + op_id(1) + data_len(1) + optional pass data */
pass_len = (p_msg->op_id == AVRC_ID_VENDOR) ? p_msg->pass_len : 0;
buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 5 + pass_len;
if (buf_size > AVRC_CMD_BUF_SIZE) {
return NULL;
}
if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
p_cmd->offset = AVCT_MSG_OFFSET;
p_cmd->layer_specific = AVCT_DATA_CTRL;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;

26
components/bt/host/bluedroid/stack/avrc/avrc_opt.c
View File

@@ -60,18 +60,20 @@ static BT_HDR *avrc_vendor_msg(tAVRC_MSG_VENDOR *p_msg)
*/
#define AVRC_MIN_VENDOR_CMD_LEN (BT_HDR_SIZE + AVCT_MSG_OFFSET + AVRC_VENDOR_HDR_SIZE)
UINT32 buf_size;
#if AVRC_METADATA_INCLUDED == TRUE
const UINT16 max_cmd_buf = AVRC_META_CMD_BUF_SIZE;
#else
const UINT16 max_cmd_buf = AVRC_CMD_BUF_SIZE;
#endif
if (!p_msg) {
return NULL;
}
#if AVRC_METADATA_INCLUDED == TRUE
if ((AVRC_META_CMD_BUF_SIZE >= AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len) &&
((p_cmd = (BT_HDR *) osi_malloc(AVRC_META_CMD_BUF_SIZE)) != NULL))
#else
if ((AVRC_CMD_BUF_SIZE >= (AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len)) &&
((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL))
#endif
{
buf_size = (UINT32)AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len;
if (buf_size <= max_cmd_buf &&
((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL)) {
p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
*p_data++ = (p_msg->hdr.ctype & AVRC_CTYPE_MASK);
@@ -115,8 +117,10 @@ UINT16 AVRC_UnitCmd(UINT8 handle, UINT8 label)
{
BT_HDR *p_cmd;
UINT8 *p_data;
/* ctype + subunit + opcode + AVRC_UNIT_OPRND_BYTES */
UINT32 buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 3 + AVRC_UNIT_OPRND_BYTES;
if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) {
if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
*p_data++ = AVRC_CMD_STATUS;
@@ -159,8 +163,10 @@ UINT16 AVRC_SubCmd(UINT8 handle, UINT8 label, UINT8 page)
{
BT_HDR *p_cmd;
UINT8 *p_data;
/* ctype + subunit + opcode + page + AVRC_SUB_OPRND_BYTES */
UINT32 buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 4 + AVRC_SUB_OPRND_BYTES;
if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) {
if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
*p_data++ = AVRC_CMD_STATUS;