From 3dbada70a4ba80872df8d58340d2cc338994024a Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Sat, 11 Oct 2025 14:42:53 +0800 Subject: [PATCH] fix(bt/bluedroid): ignore AVCT commands that are too long --- components/bt/host/bluedroid/stack/avrc/avrc_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/bt/host/bluedroid/stack/avrc/avrc_api.c b/components/bt/host/bluedroid/stack/avrc/avrc_api.c index 62a7f8a6ca..8f9646408f 100644 --- a/components/bt/host/bluedroid/stack/avrc/avrc_api.c +++ b/components/bt/host/bluedroid/stack/avrc/avrc_api.c @@ -526,7 +526,7 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr, tAVRC_MSG_VENDOR *p_msg = &msg.vendor; if (cr == AVCT_CMD && - (p_pkt->layer_specific & AVCT_DATA_CTRL && AVRC_PACKET_LEN < sizeof(p_pkt->len))) { + (p_pkt->layer_specific & AVCT_DATA_CTRL && AVRC_PACKET_LEN < p_pkt->len)) { /* Ignore the invalid AV/C command frame */ #if (BT_USE_TRACES == TRUE) p_drop_msg = "dropped - too long AV/C cmd frame size";