--- audio/avrcp.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/audio/avrcp.c b/audio/avrcp.c index c9eae6e..9b1d797 100644 --- a/audio/avrcp.c +++ b/audio/avrcp.c @@ -1228,8 +1228,10 @@ static size_t handle_vendordep_pdu(struct avctp *session, uint8_t transaction, pdu->packet_type = 0; pdu->rsvd = 0; - if (operand_count + 3 < AVRCP_HEADER_LENGTH) + if (operand_count + 3 < AVRCP_HEADER_LENGTH) { + pdu->params[0] = E_INVALID_COMMAND; goto err_metadata; + } for (handler = handlers; handler; handler++) { if (handler->pdu_id == pdu->pdu_id) -- 1.7.6.1 -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html