Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt_avrcp): size some AVRC command buffers

Browse Source
This commit is contained in:
hejiaxin
2026-09-04 11:51:39 +08:00
parent 1ccc930b04
commit b2c98e72cd
2 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/avrc/avrc_api.c
+10 -2
View File
@@ -910,11 +910,19 @@ static BT_HDR *avrc_pass_msg(tAVRC_MSG_PASS *p_msg)
{ {
BT_HDR *p_cmd = NULL; BT_HDR *p_cmd = NULL;
UINT8 *p_data; UINT8 *p_data;
UINT32 buf_size;
UINT16 pass_len;
assert(p_msg != NULL); assert(p_msg != NULL);
assert(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN+p_msg->pass_len));
if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) { /* ctype(1) + subunit(1) + opcode(1) + op_id(1) + data_len(1) + optional pass data */
pass_len = (p_msg->op_id == AVRC_ID_VENDOR) ? p_msg->pass_len : 0;
buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 5 + pass_len;
if (buf_size > AVRC_CMD_BUF_SIZE) {
return NULL;
}
if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
p_cmd->offset = AVCT_MSG_OFFSET; p_cmd->offset = AVCT_MSG_OFFSET;
p_cmd->layer_specific = AVCT_DATA_CTRL; p_cmd->layer_specific = AVCT_DATA_CTRL;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset; p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
components/bt/host/bluedroid/stack/avrc/avrc_opt.c
+16 -10
View File
@@ -60,18 +60,20 @@ static BT_HDR *avrc_vendor_msg(tAVRC_MSG_VENDOR *p_msg)
*/ */
#define AVRC_MIN_VENDOR_CMD_LEN (BT_HDR_SIZE + AVCT_MSG_OFFSET + AVRC_VENDOR_HDR_SIZE) #define AVRC_MIN_VENDOR_CMD_LEN (BT_HDR_SIZE + AVCT_MSG_OFFSET + AVRC_VENDOR_HDR_SIZE)
UINT32 buf_size;
#if AVRC_METADATA_INCLUDED == TRUE
const UINT16 max_cmd_buf = AVRC_META_CMD_BUF_SIZE;
#else
const UINT16 max_cmd_buf = AVRC_CMD_BUF_SIZE;
#endif
if (!p_msg) { if (!p_msg) {
return NULL; return NULL;
} }
#if AVRC_METADATA_INCLUDED == TRUE buf_size = (UINT32)AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len;
if ((AVRC_META_CMD_BUF_SIZE >= AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len) && if (buf_size <= max_cmd_buf &&
((p_cmd = (BT_HDR *) osi_malloc(AVRC_META_CMD_BUF_SIZE)) != NULL)) ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL)) {
#else
if ((AVRC_CMD_BUF_SIZE >= (AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len)) &&
((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL))
#endif
{
p_cmd->offset = AVCT_MSG_OFFSET; p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset; p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
*p_data++ = (p_msg->hdr.ctype & AVRC_CTYPE_MASK); *p_data++ = (p_msg->hdr.ctype & AVRC_CTYPE_MASK);
@@ -115,8 +117,10 @@ UINT16 AVRC_UnitCmd(UINT8 handle, UINT8 label)
{ {
BT_HDR *p_cmd; BT_HDR *p_cmd;
UINT8 *p_data; UINT8 *p_data;
/* ctype + subunit + opcode + AVRC_UNIT_OPRND_BYTES */
UINT32 buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 3 + AVRC_UNIT_OPRND_BYTES;
if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) { if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
p_cmd->offset = AVCT_MSG_OFFSET; p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset; p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
*p_data++ = AVRC_CMD_STATUS; *p_data++ = AVRC_CMD_STATUS;
@@ -159,8 +163,10 @@ UINT16 AVRC_SubCmd(UINT8 handle, UINT8 label, UINT8 page)
{ {
BT_HDR *p_cmd; BT_HDR *p_cmd;
UINT8 *p_data; UINT8 *p_data;
/* ctype + subunit + opcode + page + AVRC_SUB_OPRND_BYTES */
UINT32 buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 4 + AVRC_SUB_OPRND_BYTES;
if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) { if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
p_cmd->offset = AVCT_MSG_OFFSET; p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset; p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
*p_data++ = AVRC_CMD_STATUS; *p_data++ = AVRC_CMD_STATUS;