am ccebe7c2: DO NOT MERGE AVRCP: Proper handling of Fragmented AVCTP packet (80e8301c) · Commits · e / os / android_packages_modules_Bluetooth

system/btif/src/btif_rc.c

+27 −3

Original line number	Diff line number	Diff line
		@@ -1008,9 +1008,33 @@ static void btif_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8
		}
		else
		{
		num_attr = pavrc_cmd->get_elem_attrs.num_attr;
		memcpy(element_attrs, pavrc_cmd->get_elem_attrs.attrs, sizeof(UINT32)
		*pavrc_cmd->get_elem_attrs.num_attr);
		int attr_cnt, filled_attr_count;

		num_attr = 0;
		/* Attribute IDs from 1 to AVRC_MAX_NUM_MEDIA_ATTR_ID are only valid,
		* hence HAL definition limits the attributes to AVRC_MAX_NUM_MEDIA_ATTR_ID.
		* Fill only valid entries.
		*/
		for (attr_cnt = 0; (attr_cnt < pavrc_cmd->get_elem_attrs.num_attr) &&
		(num_attr < AVRC_MAX_NUM_MEDIA_ATTR_ID); attr_cnt++)
		{
		if ((pavrc_cmd->get_elem_attrs.attrs[attr_cnt] > 0) &&
		(pavrc_cmd->get_elem_attrs.attrs[attr_cnt] <= AVRC_MAX_NUM_MEDIA_ATTR_ID))
		{
		/* Skip the duplicate entries : PTS sends duplicate entries for Fragment cases
		*/
		for (filled_attr_count = 0; filled_attr_count < num_attr; filled_attr_count++)
		{
		if (element_attrs[filled_attr_count] == pavrc_cmd->get_elem_attrs.attrs[attr_cnt])
		break;
		}
		if (filled_attr_count == num_attr)
		{
		element_attrs[num_attr] = pavrc_cmd->get_elem_attrs.attrs[attr_cnt];
		num_attr++;
		}
		}
		}
		}
		FILL_PDU_QUEUE(IDX_GET_ELEMENT_ATTR_RSP, ctype, label, TRUE);
		HAL_CBACK(bt_rc_callbacks, get_element_attr_cb, num_attr, element_attrs);

+25 −7

Original line number	Diff line number	Diff line
		@@ -89,7 +89,25 @@ static BT_HDR avct_lcb_msg_asmbl(tAVCT_LCB p_lcb, BT_HDR *p_buf)
		GKI_freebuf(p_lcb->p_rx_msg);
		AVCT_TRACE_WARNING0("Got start during reassembly");
		}
		p_lcb->p_rx_msg = p_buf;
		/* Allocate bigger buffer for reassembly. As lower layers are
		* not aware of possible packet size after reassembly they
		* would have allocated smaller buffer.
		*/
		p_lcb->p_rx_msg = (BT_HDR*)GKI_getbuf(GKI_MAX_BUF_SIZE);
		if (p_lcb->p_rx_msg == NULL)
		{
		AVCT_TRACE_ERROR0 ("Cannot alloc buffer for reassembly !!");
		GKI_freebuf(p_buf);
		}
		else
		{
		memcpy (p_lcb->p_rx_msg, p_buf,
		sizeof(BT_HDR) + p_buf->offset + p_buf->len);
		/* Free original buffer */
		GKI_freebuf(p_buf);

		/* update p to point to new buffer */
		p = (UINT8 *)(p_lcb->p_rx_msg + 1) + p_lcb->p_rx_msg->offset;

		/* copy first header byte over nosp */
		(p + 1) = p;
		@@ -99,7 +117,7 @@ static BT_HDR avct_lcb_msg_asmbl(tAVCT_LCB p_lcb, BT_HDR *p_buf)

		/* adjust length for packet header */
		p_lcb->p_rx_msg->len -= 1;

		}
		p_ret = NULL;
		}
		/* continue or end */