Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2618325d authored by Android Build Coastguard Worker's avatar Android Build Coastguard Worker
Browse files

Snap for 9058783 from ec9bc950 to tm-qpr1-release 

Change-Id: Id4b193986e57facf6ec1cc1b58afe00223673f0e
parents 2cdb6d85 ec9bc950

system/stack/avct/avct_lcb_act.cc

+6 −1
Original line number Diff line number Diff line
@@ -68,7 +68,12 @@ static BT_HDR* avct_lcb_msg_asmbl(tAVCT_LCB* p_lcb, BT_HDR* p_buf) { 
  pkt_type = AVCT_PKT_TYPE(p);



  /* quick sanity check on length */

  if (p_buf->len < avct_lcb_pkt_type_len[pkt_type]) {

  if (p_buf->len < avct_lcb_pkt_type_len[pkt_type] ||

      (sizeof(BT_HDR) + p_buf->offset + p_buf->len) > BT_DEFAULT_BUFFER_SIZE) {

    if ((sizeof(BT_HDR) + p_buf->offset + p_buf->len) >

        BT_DEFAULT_BUFFER_SIZE) {

      android_errorWriteWithInfoLog(0x534e4554, "230867224", -1, NULL, 0);

    }

    osi_free(p_buf);

    AVCT_TRACE_WARNING("Bad length during reassembly");

    p_ret = NULL;

system/stack/bnep/bnep_api.cc

+1 −0
Original line number Diff line number Diff line
@@ -263,6 +263,7 @@ tBNEP_RESULT BNEP_ConnectResp(uint16_t handle, tBNEP_RESULT resp) { 
    p = (uint8_t*)(p_bcb->p_pending_data + 1) + p_bcb->p_pending_data->offset;

    while (extension_present && p && rem_len) {

      ext_type = *p++;

      rem_len--;

      extension_present = ext_type >> 7;

      ext_type &= 0x7F;