Thread (3 messages) flat view 3 messages, 3 authors, 2021-08-09
STALE1825d

[PATCH BlueZ] audio/avrcp: Use host/network order as appropriate for pdu->params_len

From: Marijn Suijten <marijn.suijten@somainline.org>
Date: 2021-08-08 14:35:39
Subsystem: the rest · Maintainer: Linus Torvalds

When comparing against or writing to pdu->params_len to enforce matching
length with total packet length, take into account that pdu->params_len
is in network order (big endian) while packet size (operand_count) is in
host order (usually little endian).

This silently breaks a number of AVRCP commands that perform a quick
length check based on params_len and bail if it doesn't match exactly.

Fixes: e2b0f0d8d ("avrcp: Fix not checking if params_len match number of received bytes")
---
 profiles/audio/avrcp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index aee2b85a2..710ab3cdd 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -1928,9 +1928,9 @@ static size_t handle_vendordep_pdu(struct avctp *conn, uint8_t transaction,
 	operands += sizeof(*pdu);
 	operand_count -= sizeof(*pdu);
 
-	if (pdu->params_len != operand_count) {
+	if (ntohs(pdu->params_len) != operand_count) {
 		DBG("AVRCP PDU parameters length don't match");
-		pdu->params_len = operand_count;
+		pdu->params_len = htons(operand_count);
 	}
 
 	for (handler = session->control_handlers; handler->pdu_id; handler++) {
-- 
2.32.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help