Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58ae8893 authored by Ted Wang's avatar Ted Wang
Browse files

L2CAP ERTM: Fix infinite loop in retransmit_i_frame 

Bug: 146255712
Test: run_cert.sh
Change-Id: If6342b39ccfcad31bccf54b0dedcad5c7e6aa1e8
parent c4a799be

system/gd/l2cap/internal/enhanced_retransmission_mode_channel_data_controller.cc

+5 −2
Original line number Original line Diff line number Diff line
@@ -729,7 +729,7 @@ struct ErtmController::impl { 
  void retransmit_i_frames(uint8_t req_seq, Poll p = Poll::NOT_SET) {

  void retransmit_i_frames(uint8_t req_seq, Poll p = Poll::NOT_SET) {

    uint8_t i = req_seq;

    uint8_t i = req_seq;

    Final f = (p == Poll::NOT_SET ? Final::NOT_SET : Final::POLL_RESPONSE);

    Final f = (p == Poll::NOT_SET ? Final::NOT_SET : Final::POLL_RESPONSE);

    while (unacked_list_.find(i) == unacked_list_.end()) {

    while (unacked_list_.find(i) != unacked_list_.end()) {

      std::unique_ptr<CopyablePacketBuilder> copyable_packet_builder =

      std::unique_ptr<CopyablePacketBuilder> copyable_packet_builder =

          std::make_unique<CopyablePacketBuilder>(std::get<2>(unacked_list_.find(i)->second));

          std::make_unique<CopyablePacketBuilder>(std::get<2>(unacked_list_.find(i)->second));

      _send_i_frame(std::get<0>(unacked_list_.find(i)->second), std::move(copyable_packet_builder), buffer_seq_, i,

      _send_i_frame(std::get<0>(unacked_list_.find(i)->second), std::move(copyable_packet_builder), buffer_seq_, i,
@@ -740,9 +740,12 @@ struct ErtmController::impl { 
      }

      }

      frames_sent_++;

      frames_sent_++;

      f = Final::NOT_SET;

      f = Final::NOT_SET;

      i++;

    }

    }

    if (i != req_seq) {

      start_retrans_timer();

      start_retrans_timer();

    }

    }

  }





  void retransmit_requested_i_frame(uint8_t req_seq, Poll p) {

  void retransmit_requested_i_frame(uint8_t req_seq, Poll p) {

    Final f = p == Poll::POLL ? Final::POLL_RESPONSE : Final::NOT_SET;

    Final f = p == Poll::POLL ? Final::POLL_RESPONSE : Final::NOT_SET;