Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0faeacd7 authored by Anubhav Gupta's avatar Anubhav Gupta Committed by Pavlin Radoslavov
Browse files

Fix a bug allocating buffers for fragmented AVRC packets 

Use the correct offset_len when allocating buffers for AVRC
packets that need to be fragmented.

Bug: 22156175

Change-Id: I7db12474c84edacb4f0739d50a43e8cebdcca676
parent 41cc9f72

system/stack/avrc/avrc_api.c

100644 → 100755
+9 −4
Original line number Diff line number Diff line
@@ -189,11 +189,13 @@ static void avrc_send_continue_frag(UINT8 handle, UINT8 label) 
    p_fcb = &avrc_cb.fcb[handle];

    p_pkt = p_fcb->p_fmsg;



    AVRC_TRACE_DEBUG ("avrc_send_continue_frag len(%d) / AVRC_MAX_CTRL_DATA_LEN", p_pkt->len );

    AVRC_TRACE_DEBUG("%s handle = %u label = %u len = %d",

                     __func__, handle, label, p_pkt->len);

    if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN)

    {

        int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);

        p_pkt_old = p_fcb->p_fmsg;

        p_pkt = (BT_HDR *)GKI_getbuf((UINT16)(AVRC_PACKET_LEN + AVCT_MSG_OFFSET + BT_HDR_SIZE));

        p_pkt = (BT_HDR *)GKI_getbuf((UINT16)(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE));

        if (p_pkt)

        {

            p_pkt->len          = AVRC_MAX_CTRL_DATA_LEN;
@@ -988,6 +990,9 @@ UINT16 AVRC_MsgReq (UINT8 handle, UINT8 label, UINT8 ctype, BT_HDR *p_pkt) 
    if (!p_pkt)

        return AVRC_BAD_PARAM;



    AVRC_TRACE_DEBUG("%s handle = %u label = %u ctype = %u len = %d",

                     __func__, handle, label, ctype, p_pkt->len);



    if (ctype >= AVRC_RSP_NOT_IMPL)

        cr = AVCT_RSP;
@@ -1035,8 +1040,8 @@ UINT16 AVRC_MsgReq (UINT8 handle, UINT8 label, UINT8 ctype, BT_HDR *p_pkt) 
    {

        if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN)

        {

            AVRC_TRACE_DEBUG ("p_pkt->len(%d) > AVRC_MAX_CTRL_DATA_LEN", p_pkt->len );

            p_pkt_new = (BT_HDR *)GKI_getbuf((UINT16)(AVRC_PACKET_LEN + AVCT_MSG_OFFSET

            int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);

            p_pkt_new = (BT_HDR *)GKI_getbuf((UINT16)(AVRC_PACKET_LEN + offset_len

                + BT_HDR_SIZE));

            if (p_pkt_new && (p_start != NULL))

            {