Merge pie-platform-release to aosp-master - DO NOT MERGE (7e771390) · Commits · e / os / android_packages_modules_Bluetooth

system/bta/av/bta_av_act.cc

+7 −1

Original line number	Diff line number	Diff line
		@@ -35,6 +35,7 @@
		#include "bta_av_api.h"
		#include "bta_av_int.h"
		#include "l2c_api.h"
		#include "log/log.h"
		#include "osi/include/list.h"
		#include "osi/include/log.h"
		#include "osi/include/osi.h"
		@@ -785,11 +786,16 @@ tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE* p_rc_rsp,
		case AVRC_PDU_GET_CAPABILITIES:
		/* process GetCapabilities command without reporting the event to app */
		evt = 0;
		if (p_vendor->vendor_len != 5) {
		android_errorWriteLog(0x534e4554, "111893951");
		p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
		break;
		}
		u8 = *(p_vendor->p_vendor_data + 4);
		p = p_vendor->p_vendor_data + 2;
		p_rc_rsp->get_caps.capability_id = u8;
		BE_STREAM_TO_UINT16(u16, p);
		if ((u16 != 1) \|\| (p_vendor->vendor_len != 5)) {
		if (u16 != 1) {
		p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
		} else {
		p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;

system/stack/avrc/avrc_api.cc

+27 −0

Original line number	Diff line number	Diff line
		@@ -24,6 +24,8 @@
		#include <base/logging.h>
		#include <string.h>

		#include <log/log.h>

		#include "avrc_api.h"
		#include "avrc_int.h"
		#include "bt_common.h"
		@@ -660,6 +662,13 @@ static void avrc_msg_cback(uint8_t handle, uint8_t label, uint8_t cr,
		msg.browse.browse_len = p_pkt->len;
		msg.browse.p_browse_pkt = p_pkt;
		} else {
		if (p_pkt->len < AVRC_AVC_HDR_SIZE) {
		android_errorWriteLog(0x534e4554, "111803925");
		AVRC_TRACE_WARNING("%s: message length %d too short: must be at least %d",
		__func__, p_pkt->len, AVRC_AVC_HDR_SIZE);
		osi_free(p_pkt);
		return;
		}
		msg.hdr.ctype = p_data[0] & AVRC_CTYPE_MASK;
		AVRC_TRACE_DEBUG("%s handle:%d, ctype:%d, offset:%d, len: %d", __func__,
		handle, msg.hdr.ctype, p_pkt->offset, p_pkt->len);
		@@ -693,6 +702,15 @@ static void avrc_msg_cback(uint8_t handle, uint8_t label, uint8_t cr,
		p_drop_msg = "auto respond";
		} else {
		/* parse response */
		if (p_pkt->len < AVRC_OP_UNIT_INFO_RSP_LEN) {
		AVRC_TRACE_WARNING(
		"%s: message length %d too short: must be at least %d",
		__func__, p_pkt->len, AVRC_OP_UNIT_INFO_RSP_LEN);
		android_errorWriteLog(0x534e4554, "79883824");
		drop = true;
		p_drop_msg = "UNIT_INFO_RSP too short";
		break;
		}
		p_data += 4; /* 3 bytes: ctype, subunit, opcode + octet 3 (is 7)/
		msg.unit.unit_type =
		(*p_data & AVRC_SUBTYPE_MASK) >> AVRC_SUBTYPE_SHIFT;
		@@ -722,6 +740,15 @@ static void avrc_msg_cback(uint8_t handle, uint8_t label, uint8_t cr,
		p_drop_msg = "auto responded";
		} else {
		/* parse response */
		if (p_pkt->len < AVRC_OP_SUB_UNIT_INFO_RSP_LEN) {
		AVRC_TRACE_WARNING(
		"%s: message length %d too short: must be at least %d",
		__func__, p_pkt->len, AVRC_OP_SUB_UNIT_INFO_RSP_LEN);
		android_errorWriteLog(0x534e4554, "79883824");
		drop = true;
		p_drop_msg = "SUB_UNIT_INFO_RSP too short";
		break;
		}
		p_data += AVRC_AVC_HDR_SIZE; /* 3 bytes: ctype, subunit, opcode /
		msg.sub.page =
		(*p_data++ >> AVRC_SUB_PAGE_SHIFT) & AVRC_SUB_PAGE_MASK;

system/stack/avrc/avrc_pars_ct.cc

+5 −0

Original line number	Diff line number	Diff line
		@@ -482,6 +482,11 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
		break;
		}
		BE_STREAM_TO_UINT8(p_result->list_app_values.num_val, p);
		if (p_result->list_app_values.num_val > AVRC_MAX_APP_ATTR_SIZE) {
		android_errorWriteLog(0x534e4554, "78526423");
		p_result->list_app_values.num_val = AVRC_MAX_APP_ATTR_SIZE;
		}

		AVRC_TRACE_DEBUG("%s value count = %d ", __func__,
		p_result->list_app_values.num_val);
		for (int xx = 0; xx < p_result->list_app_values.num_val; xx++) {

system/stack/mcap/mca_cact.cc

+8 −1

Original line number	Diff line number	Diff line
		@@ -22,6 +22,7 @@
		* Functions.
		*
		******************************************************************************/
		#include <log/log.h>
		#include <string.h>
		#include "bt_common.h"
		#include "bt_target.h"
		@@ -251,9 +252,15 @@ void mca_ccb_hdl_req(tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) {
		p_rx_msg = (tMCA_CCB_MSG*)p_pkt;
		p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
		evt_data.hdr.op_code = *p++;
		BE_STREAM_TO_UINT16(evt_data.hdr.mdl_id, p);
		reject_opcode = evt_data.hdr.op_code + 1;

		if (p_pkt->len >= 3) {
		BE_STREAM_TO_UINT16(evt_data.hdr.mdl_id, p);
		} else {
		android_errorWriteLog(0x534e4554, "110791536");
		evt_data.hdr.mdl_id = 0;
		}

		MCA_TRACE_DEBUG("received mdl id: %d ", evt_data.hdr.mdl_id);
		if (p_ccb->status == MCA_CCB_STAT_PENDING) {
		MCA_TRACE_DEBUG("received req inpending state");

system/stack/rfcomm/rfc_ts_frames.cc

+22 −1

Original line number	Diff line number	Diff line
		@@ -627,6 +627,14 @@ void rfc_process_mx_message(tRFC_MCB* p_mcb, BT_HDR* p_buf) {
		uint16_t length = p_buf->len;
		uint8_t ea, cr, mx_len;

		if (length < 2) {
		RFCOMM_TRACE_ERROR(
		"%s: Illegal MX Frame len when reading EA, C/R. len:%d < 2", __func__,
		length);
		android_errorWriteLog(0x534e4554, "111937065");
		osi_free(p_buf);
		return;
		}
		p_rx_frame->ea = *p_data & RFCOMM_EA;
		p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;
		p_rx_frame->type = *p_data++ & ~(RFCOMM_CR_MASK \| RFCOMM_EA_MASK);
		@@ -649,6 +657,13 @@ void rfc_process_mx_message(tRFC_MCB* p_mcb, BT_HDR* p_buf) {
		length--;

		if (!ea) {
		if (length < 1) {
		RFCOMM_TRACE_ERROR("%s: Illegal MX Frame when EA = 0. len:%d < 1",
		__func__, length);
		android_errorWriteLog(0x534e4554, "111937065");
		osi_free(p_buf);
		return;
		}
		mx_len += *p_data++ << RFCOMM_SHIFT_LENGTH2;
		length--;
		}
		@@ -725,7 +740,13 @@ void rfc_process_mx_message(tRFC_MCB* p_mcb, BT_HDR* p_buf) {
		return;

		case RFCOMM_MX_MSC:

		if (length != RFCOMM_MX_MSC_LEN_WITH_BREAK &&
		length != RFCOMM_MX_MSC_LEN_NO_BREAK) {
		RFCOMM_TRACE_ERROR("%s: Illegal MX MSC Frame len:%d", __func__, length);
		android_errorWriteLog(0x534e4554, "111937065");
		osi_free(p_buf);
		return;
		}
		ea = *p_data & RFCOMM_EA;
		cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;
		p_rx_frame->dlci = *p_data++ >> RFCOMM_SHIFT_DLCI;