Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3523f3e2 authored by Ayan Ghosh's avatar Ayan Ghosh Committed by Andre Eisenbach
Browse files

Allocate buffer for AV SDP in Stack 

Remove buffer allocation in BTA while going for SDP before triggering
A2DP connection. This strategy is followed to address memory corruption
issues due to freeing of BTA buffer before SDP RSP call back is
triggered and access the freed buffer from there, leads to crash when
running Codemonicom tests.

The change allocates and frees buffer in stack.

Change-Id: If6d60d2aa60d19ce5120dd38c2f365d70943db81
parent 73a8950f

system/bta/av/bta_av_aact.c

+25 −30
Original line number Diff line number Diff line
@@ -1010,20 +1010,17 @@ void bta_av_do_disc_a2d (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data) 
        bta_av_a2d_sdp_cback(TRUE, &a2d_ser);

        return;

    }

    /* allocate discovery database */

    if (p_scb->p_disc_db == NULL)

        p_scb->p_disc_db = (tSDP_DISCOVERY_DB *) osi_malloc (BTA_AV_DISC_BUF_SIZE);



    /* only one A2D find service is active at a time */

    bta_av_cb.handle = p_scb->hndl;



    if(p_scb->p_disc_db)

    {

    /* set up parameters */

    db_params.db_len = BTA_AV_DISC_BUF_SIZE;

    db_params.num_attr = 3;

        db_params.p_db = p_scb->p_disc_db;

    db_params.p_db = NULL;

    db_params.p_attrs = attr_list;

    p_scb->uuid_int = p_data->api_open.uuid;

    p_scb->sdp_discovery_started = TRUE;

    if (p_scb->uuid_int == UUID_SERVCLASS_AUDIO_SINK)

        sdp_uuid = UUID_SERVCLASS_AUDIO_SOURCE;

    else if (p_scb->uuid_int == UUID_SERVCLASS_AUDIO_SOURCE)
@@ -1039,7 +1036,6 @@ void bta_av_do_disc_a2d (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data) 
     * or A2D_FindService is not successful */

    bta_av_a2d_sdp_cback(FALSE, NULL);

}

}



/*******************************************************************************

**
@@ -1060,7 +1056,7 @@ void bta_av_cleanup(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data) 


    /* free any buffers */

    osi_free_and_reset((void **)&p_scb->p_cap);

    osi_free_and_reset((void **)&p_scb->p_disc_db);

    p_scb->sdp_discovery_started = FALSE;

    p_scb->avdt_version = 0;



    /* initialize some control block variables */
@@ -1117,7 +1113,7 @@ void bta_av_cleanup(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data) 
void bta_av_free_sdb(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)

{

    UNUSED(p_data);

    osi_free_and_reset((void **)&p_scb->p_disc_db);

    p_scb->sdp_discovery_started = FALSE;

}



/*******************************************************************************
@@ -1567,8 +1563,7 @@ void bta_av_connect_req(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data) 
{

    UNUSED(p_data);



    osi_free_and_reset((void **)&p_scb->p_disc_db);



    p_scb->sdp_discovery_started = FALSE;

    if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)

    {

        /* SNK initiated L2C connection while SRC was doing SDP.    */
@@ -1594,7 +1589,7 @@ void bta_av_sdp_failed(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data) 
    if (!p_scb->open_status)

        p_scb->open_status = BTA_AV_FAIL_SDP;



    osi_free_and_reset((void **)&p_scb->p_disc_db);

    p_scb->sdp_discovery_started = FALSE;

    bta_av_str_closed(p_scb, p_data);

}

system/bta/av/bta_av_act.c

+1 −1
Original line number Diff line number Diff line
@@ -1605,7 +1605,7 @@ static void bta_av_accept_signalling_timer_cback(void *data) 


            if (bta_av_is_scb_opening(p_scb))

            {

                if (p_scb->p_disc_db)

                if (p_scb->sdp_discovery_started)

                {

                    /* We are still doing SDP. Run the timer again. */

                    p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;

system/bta/av/bta_av_int.h

+1 −1
Original line number Diff line number Diff line
@@ -479,7 +479,7 @@ typedef struct 
{

    const tBTA_AV_ACT   *p_act_tbl;     /* the action table for stream state machine */

    const tBTA_AV_CO_FUNCTS *p_cos;     /* the associated callout functions */

    tSDP_DISCOVERY_DB   *p_disc_db;     /* pointer to discovery database */

    BOOLEAN             sdp_discovery_started; /* variable to determine whether SDP is started */

    tBTA_AV_SEP         seps[BTA_AV_MAX_SEPS];

    tAVDT_CFG           *p_cap;         /* buffer used for get capabilities */

    list_t              *a2d_list;      /* used for audio channels only */

system/stack/a2dp/a2d_api.c

+8 −3
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
 ******************************************************************************/

#include <string.h>

#include "bt_target.h"

#include "bt_common.h"

#include "sdpdefs.h"

#include "a2d_api.h"

#include "a2d_int.h"
@@ -112,6 +113,7 @@ static void a2d_sdp_cback(UINT16 status) 
    }



    a2d_cb.find.service_uuid = 0;

    osi_free_and_reset((void**)&a2d_cb.find.p_db);

    /* return info from sdp record in app callback function */

    if (a2d_cb.find.p_cback != NULL)

    {
@@ -279,7 +281,7 @@ tA2D_STATUS A2D_FindService(UINT16 service_uuid, BD_ADDR bd_addr, 


    A2D_TRACE_API("A2D_FindService uuid: %x", service_uuid);

    if( (service_uuid != UUID_SERVCLASS_AUDIO_SOURCE && service_uuid != UUID_SERVCLASS_AUDIO_SINK) ||

        p_db == NULL || p_db->p_db == NULL || p_cback == NULL)

        p_db == NULL || p_cback == NULL)

        return A2D_INVALID_PARAMS;



    if( a2d_cb.find.service_uuid == UUID_SERVCLASS_AUDIO_SOURCE ||
@@ -296,7 +298,10 @@ tA2D_STATUS A2D_FindService(UINT16 service_uuid, BD_ADDR bd_addr, 
        p_db->num_attr = A2D_NUM_ATTR;

    }



    result = SDP_InitDiscoveryDb(p_db->p_db, p_db->db_len, 1, &uuid_list, p_db->num_attr,

    if(a2d_cb.find.p_db == NULL)

        a2d_cb.find.p_db = (tSDP_DISCOVERY_DB*)osi_malloc(p_db->db_len);



    result = SDP_InitDiscoveryDb(a2d_cb.find.p_db, p_db->db_len, 1, &uuid_list, p_db->num_attr,

                                 p_db->p_attrs);



    if (result == TRUE)
@@ -307,7 +312,7 @@ tA2D_STATUS A2D_FindService(UINT16 service_uuid, BD_ADDR bd_addr, 
        a2d_cb.find.p_cback = p_cback;



        /* perform service search */

        result = SDP_ServiceSearchAttributeRequest(bd_addr, p_db->p_db, a2d_sdp_cback);

        result = SDP_ServiceSearchAttributeRequest(bd_addr, a2d_cb.find.p_db, a2d_sdp_cback);

        if(FALSE == result)

        {

            a2d_cb.find.service_uuid = 0;