diff options
| author | Marijn Suijten <marijn.suijten@somainline.org> | 2021-08-08 16:35:26 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2021-08-09 13:33:53 -0700 |
| commit | e21680c9355a0f9d5ef6d4a5ae032de274e87b37 (patch) | |
| tree | f78a40f98636eaba168598ce0024c4f436f0599a /profiles | |
| parent | c944e5f1940930d64ce92be591700b0f84080c36 (diff) | |
| download | bluez-e21680c9355a0f9d5ef6d4a5ae032de274e87b37.tar.gz | |
audio/avrcp: Use host/network order as appropriate for pdu->params_len
When comparing against or writing to pdu->params_len to enforce matching
length with total packet length, take into account that pdu->params_len
is in network order (big endian) while packet size (operand_count) is in
host order (usually little endian).
This silently breaks a number of AVRCP commands that perform a quick
length check based on params_len and bail if it doesn't match exactly.
Fixes: e2b0f0d8d ("avrcp: Fix not checking if params_len match number of received bytes")
Diffstat (limited to 'profiles')
| -rw-r--r-- | profiles/audio/avrcp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c index ccf34b220..22bd5df20 100644 --- a/profiles/audio/avrcp.c +++ b/profiles/audio/avrcp.c @@ -1923,9 +1923,9 @@ static size_t handle_vendordep_pdu(struct avctp *conn, uint8_t transaction, operands += sizeof(*pdu); operand_count -= sizeof(*pdu); - if (pdu->params_len != operand_count) { + if (ntohs(pdu->params_len) != operand_count) { DBG("AVRCP PDU parameters length don't match"); - pdu->params_len = operand_count; + pdu->params_len = htons(operand_count); } for (handler = session->control_handlers; handler->pdu_id; handler++) { |