avrcp_target: check data of AVRCP_PDU_ID_PLAY_ITEM packet

This commit is contained in:
Milanka Ringwald 2025-01-24 10:33:27 +01:00
parent 5933f6e8c6
commit 3095a00a4c

View File

@ -1170,12 +1170,16 @@ static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connec
connection->target_scope = packet[pos++];
if (connection->target_scope >= AVRCP_BROWSING_RFU){
avrcp_target_vendor_dependent_response_accept(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
return;
}
memcpy(connection->target_track_id, &packet[pos], 8);
pos += 8;
connection->target_uid_counter = big_endian_read_16(packet,pos);
uid_counter = big_endian_read_16(packet,pos);
if (connection->target_uid_counter != uid_counter){
avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_PARAMETER_CONTENT_ERROR);
return;
}
connection->state = AVCTP_W2_CHECK_DATABASE;
avrcp_target_emit_respond_play_item(avrcp_target_context.avrcp_callback, connection->avrcp_cid, connection->target_uid_counter, connection->target_scope,connection->target_track_id);
break;