Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fea8bd7 authored by android-build-team Robot's avatar android-build-team Robot
Browse files

Snap for 4945494 from 187b0002 to pi-qpr1-release 

Change-Id: I4696e8ccbfbd4a64b65f4563e0e56fcc5e5a1c75
parents c559f174 187b0002

system/stack/rfcomm/rfc_ts_frames.cc

+22 −1
Original line number Original line Diff line number Diff line
@@ -621,6 +621,14 @@ void rfc_process_mx_message(tRFC_MCB* p_mcb, BT_HDR* p_buf) { 
  uint8_t ea, cr, mx_len;

  uint8_t ea, cr, mx_len;

  bool is_command;

  bool is_command;





  if (length < 2) {

    RFCOMM_TRACE_ERROR(

        "%s: Illegal MX Frame len when reading EA, C/R. len:%d < 2", __func__,

        length);

    android_errorWriteLog(0x534e4554, "111937065");

    osi_free(p_buf);

    return;

  }

  p_rx_frame->ea = *p_data & RFCOMM_EA;

  p_rx_frame->ea = *p_data & RFCOMM_EA;

  p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;

  p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;

  p_rx_frame->type = *p_data++ & ~(RFCOMM_CR_MASK | RFCOMM_EA_MASK);

  p_rx_frame->type = *p_data++ & ~(RFCOMM_CR_MASK | RFCOMM_EA_MASK);
@@ -643,6 +651,13 @@ void rfc_process_mx_message(tRFC_MCB* p_mcb, BT_HDR* p_buf) { 
  length--;

  length--;





  if (!ea) {

  if (!ea) {

    if (length < 1) {

      RFCOMM_TRACE_ERROR("%s: Illegal MX Frame when EA = 0. len:%d < 1",

                         __func__, length);

      android_errorWriteLog(0x534e4554, "111937065");

      osi_free(p_buf);

      return;

    }

    mx_len += *p_data++ << RFCOMM_SHIFT_LENGTH2;

    mx_len += *p_data++ << RFCOMM_SHIFT_LENGTH2;

    length--;

    length--;

  }

  }
@@ -719,7 +734,13 @@ void rfc_process_mx_message(tRFC_MCB* p_mcb, BT_HDR* p_buf) { 
      return;

      return;





    case RFCOMM_MX_MSC:

    case RFCOMM_MX_MSC:



      if (length != RFCOMM_MX_MSC_LEN_WITH_BREAK &&

          length != RFCOMM_MX_MSC_LEN_NO_BREAK) {

        RFCOMM_TRACE_ERROR("%s: Illegal MX MSC Frame len:%d", __func__, length);

        android_errorWriteLog(0x534e4554, "111937065");

        osi_free(p_buf);

        return;

      }

      ea = *p_data & RFCOMM_EA;

      ea = *p_data & RFCOMM_EA;

      cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;

      cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;

      p_rx_frame->dlci = *p_data++ >> RFCOMM_SHIFT_DLCI;

      p_rx_frame->dlci = *p_data++ >> RFCOMM_SHIFT_DLCI;

system/stack/sdp/sdp_discovery.cc

+7 −0
Original line number Original line Diff line number Diff line
@@ -357,8 +357,15 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) { 
    p = &p_ccb->rsp_list[0];

    p = &p_ccb->rsp_list[0];





    if (offset) {

    if (offset) {

      cpy_len -= 1;

      type = *p++;

      type = *p++;

      uint8_t* old_p = p;

      p = sdpu_get_len_from_type(p, type, &list_len);

      p = sdpu_get_len_from_type(p, type, &list_len);

      if ((int)cpy_len < (p - old_p)) {

        SDP_TRACE_WARNING("%s: no bytes left for data", __func__);

        return;

      }

      cpy_len -= (p - old_p);

    }

    }

    if (list_len < cpy_len) {

    if (list_len < cpy_len) {

      cpy_len = list_len;

      cpy_len = list_len;