Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5db910a8 authored by Jack He's avatar Jack He Committed by Android (Google) Code Review
Browse files

Merge changes from topic "cherrypicker-L64700000955439487:N10200001278963420" into tm-d1-dev 

* changes:
  l2cap: Fix Le Coc payload length checking
  l2cap: handle le connection response error
parents d1a740b9 77dac5bf

system/stack/l2cap/l2c_ble.cc

+1 −0
Original line number Diff line number Diff line
@@ -669,6 +669,7 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) { 
       * all the channels has been rejected

       */

      if (con_info.l2cap_result == L2CAP_LE_RESULT_NO_PSM ||

          con_info.l2cap_result == L2CAP_LE_RESULT_NO_RESOURCES ||

          con_info.l2cap_result ==

              L2CAP_LE_RESULT_INSUFFICIENT_AUTHENTICATION ||

          con_info.l2cap_result == L2CAP_LE_RESULT_INSUFFICIENT_ENCRYP ||

system/stack/l2cap/l2c_fcr.cc

+9 −2
Original line number Diff line number Diff line
@@ -681,8 +681,12 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 


  /* Buffer length should not exceed local mps */

  if (p_buf->len > p_ccb->local_conn_cfg.mps) {

    /* Discard the buffer */

    LOG_ERROR("buffer length=%d exceeds local mps=%d. Drop and disconnect.",

              p_buf->len, p_ccb->local_conn_cfg.mps);



    /* Discard the buffer and disconnect*/

    osi_free(p_buf);

    l2cu_disconnect_chnl(p_ccb);

    return;

  }
@@ -699,8 +703,11 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 


    /* Check the SDU Length with local MTU size */

    if (sdu_length > p_ccb->local_conn_cfg.mtu) {

      /* Discard the buffer */

      LOG_ERROR("sdu length=%d exceeds local mtu=%d. Drop and disconnect.",

                sdu_length, p_ccb->local_conn_cfg.mtu);

      /* Discard the buffer and disconnect*/

      osi_free(p_buf);

      l2cu_disconnect_chnl(p_ccb);

      return;

    }