Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue,  8 Jun 2021 10:39:50 -0700
Message-Id: <20210608103940.BlueZ.v1.1.Ifed45e2dfac25b2627fcaabc66cd29f6894ba07b@changeid>
Mime-Version: 1.0
Subject: [BlueZ PATCH v1] avrcp: fix byte order of PDU parameter length compare
From:   Michael Sun <michaelfsun@google.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     chromeos-bluetooth-upstreaming@chromium.org,
        Michael Sun <michaelfsun@google.com>,
        Alain Michaud <alainm@chromium.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Fix the issue that directly uses params_len, from received PDU data,
for arithmetic calculation and comparison.

Reviewed-by: Alain Michaud <alainm@chromium.org>
Signed-off-by: Michael Sun <michaelfsun@google.com>
---

 profiles/audio/avrcp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index ccf34b220..2265f87ab 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -1923,9 +1923,9 @@ static size_t handle_vendordep_pdu(struct avctp *conn, uint8_t transaction,
 	operands += sizeof(*pdu);
 	operand_count -= sizeof(*pdu);
 
-	if (pdu->params_len != operand_count) {
+	if (pdu->params_len != htons(operand_count)) {
 		DBG("AVRCP PDU parameters length don't match");
-		pdu->params_len = operand_count;
+		pdu->params_len = htons(operand_count);
 	}
 
 	for (handler = session->control_handlers; handler->pdu_id; handler++) {
-- 
2.32.0.rc1.229.g3e70b5a671-goog