Add an explicit check for AVRCP vendor data

Add an explicit check for AVRCP vendor data when parsing received vendor
commands or responses.

Bug: 21768387
Change-Id: I715de6fc7348d063c448971a8dae6dd1b00c7062

stack/avrc/avrc_pars_ct.c

@@ -43,10 +43,17 @@
 static tAVRC_STS avrc_pars_vendor_rsp(tAVRC_MSG_VENDOR *p_msg, tAVRC_RESPONSE *p_result)
 {
     tAVRC_STS  status = AVRC_STS_NO_ERROR;
-    UINT8   *p = p_msg->p_vendor_data;
+    UINT8   *p;
     UINT16  len;
     UINT8 eventid=0;
 
+    /* Check the vendor data */
+    if (p_msg->vendor_len == 0)
+        return AVRC_STS_NO_ERROR;
+    if (p_msg->p_vendor_data == NULL)
+        return AVRC_STS_INTERNAL_ERR;
+
+    p = p_msg->p_vendor_data;
     BE_STREAM_TO_UINT8 (p_result->pdu, p);
     p++; /* skip the reserved/packe_type byte */
     BE_STREAM_TO_UINT16 (len, p);

stack/avrc/avrc_pars_tg.c

@@ -42,7 +42,7 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
                                       UINT8 *p_buf, UINT16 buf_len)
 {
     tAVRC_STS  status = AVRC_STS_NO_ERROR;
-    UINT8   *p = p_msg->p_vendor_data;
+    UINT8   *p;
     UINT16  len;
     UINT8   xx, yy;
     UINT8   *p_u8;
@@ -51,6 +51,13 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
     tAVRC_APP_SETTING       *p_app_set;
     UINT16  size_needed;
 
+    /* Check the vendor data */
+    if (p_msg->vendor_len == 0)
+        return AVRC_STS_NO_ERROR;
+    if (p_msg->p_vendor_data == NULL)
+        return AVRC_STS_INTERNAL_ERR;
+
+    p = p_msg->p_vendor_data;
     p_result->pdu = *p++;
     AVRC_TRACE_DEBUG("avrc_pars_vendor_cmd() pdu:0x%x", p_result->pdu);
     if (!AVRC_IsValidAvcType (p_result->pdu, p_msg->hdr.ctype))