Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d874397 authored by Hansong Zhang's avatar Hansong Zhang Committed by android-build-merger
Browse files

Merge "btm_ble_multi_adv: Check data length in HCI interface" into oc-dev 

am: b7007ebf

Change-Id: If4f3b40817ff57bdae4777ae330854a9119ae0b7
parents 47cd6fcf b7007ebf

system/stack/btm/ble_advertiser_hci_interface.cc

+35 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#include "btm_int_types.h"

#include "device/include/controller.h"

#include "hcidefs.h"

#include "log/log.h"



#define BTM_BLE_MULTI_ADV_SET_RANDOM_ADDR_LEN 8

#define BTM_BLE_MULTI_ADV_ENB_LEN 3
@@ -162,6 +163,14 @@ class BleAdvertiserVscHciInterfaceImpl : public BleAdvertiserHciInterface { 
    uint8_t param[BTM_BLE_MULTI_ADV_WRITE_DATA_LEN];

    memset(param, 0, BTM_BLE_MULTI_ADV_WRITE_DATA_LEN);



    if (data_length > BTM_BLE_AD_DATA_LEN) {

      android_errorWriteLog(0x534e4554, "121145627");

      LOG(ERROR) << __func__

                 << ": data_length=" << static_cast<int>(data_length)

                 << ", is longer than size limit " << BTM_BLE_AD_DATA_LEN;

      data_length = BTM_BLE_AD_DATA_LEN;

    }



    uint8_t* pp = param;

    UINT8_TO_STREAM(pp, BTM_BLE_MULTI_ADV_WRITE_ADV_DATA);

    UINT8_TO_STREAM(pp, data_length);
@@ -181,6 +190,14 @@ class BleAdvertiserVscHciInterfaceImpl : public BleAdvertiserHciInterface { 
    uint8_t param[BTM_BLE_MULTI_ADV_WRITE_DATA_LEN];

    memset(param, 0, BTM_BLE_MULTI_ADV_WRITE_DATA_LEN);



    if (scan_response_data_length > BTM_BLE_AD_DATA_LEN) {

      android_errorWriteLog(0x534e4554, "121145627");

      LOG(ERROR) << __func__ << ": scan_response_data_length="

                 << static_cast<int>(scan_response_data_length)

                 << ", is longer than size limit " << BTM_BLE_AD_DATA_LEN;

      scan_response_data_length = BTM_BLE_AD_DATA_LEN;

    }



    uint8_t* pp = param;

    UINT8_TO_STREAM(pp, BTM_BLE_MULTI_ADV_WRITE_SCAN_RSP_DATA);

    UINT8_TO_STREAM(pp, scan_response_data_length);
@@ -363,6 +380,15 @@ class BleAdvertiserLegacyHciInterfaceImpl : public BleAdvertiserHciInterface { 


    uint8_t param[HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1];



    if (data_length > HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA) {

      android_errorWriteLog(0x534e4554, "121145627");

      LOG(ERROR) << __func__

                 << ": data_length=" << static_cast<int>(data_length)

                 << ", is longer than size limit "

                 << HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA;

      data_length = HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA;

    }



    uint8_t* pp = param;

    memset(pp, 0, HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1);

    UINT8_TO_STREAM(pp, data_length);
@@ -380,6 +406,15 @@ class BleAdvertiserLegacyHciInterfaceImpl : public BleAdvertiserHciInterface { 
    VLOG(1) << __func__;

    uint8_t param[HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1];



    if (scan_response_data_length > HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA) {

      android_errorWriteLog(0x534e4554, "121145627");

      LOG(ERROR) << __func__ << ": scan_response_data_length="

                 << static_cast<int>(scan_response_data_length)

                 << ", is longer than size limit "

                 << HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA;

      scan_response_data_length = HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA;

    }



    uint8_t* pp = param;

    memset(pp, 0, HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1);

    UINT8_TO_STREAM(pp, scan_response_data_length);