fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write

This commit is contained in:
Jin Cheng
2025-10-11 14:17:24 +08:00
parent ce34d1a42c
commit 53efa32ee0

View File

@@ -242,7 +242,11 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
status = AVRC_STS_INTERNAL_ERR;
} else {
BE_STREAM_TO_UINT8 (p_result->reg_notif.event_id, p);
BE_STREAM_TO_UINT32 (p_result->reg_notif.param, p);
if (AVRC_IS_VALID_EVENT_ID(p_result->reg_notif.event_id)) {
BE_STREAM_TO_UINT32 (p_result->reg_notif.param, p);
} else {
status = AVRC_STS_BAD_PARAM;
}
}
break;