Snap for 7495277 from 8db080608a5c07881276257f767f6ef5e5d044b4 to sc-release (8b4d04a6) · Commits · e / os / android_packages_modules_Bluetooth

system/hci/src/packet_fragmenter.cc

+16 −2

Original line number	Diff line number	Diff line
		@@ -254,8 +254,10 @@ static void reassemble_and_dispatch_iso(UNUSED_ATTR BT_HDR* packet) {
		return;
		}

		if ((boundary_flag == HCI_ISO_BF_COMPLETE_PACKET) &&
		(iso_full_len != packet->len)) {
		if (((boundary_flag == HCI_ISO_BF_COMPLETE_PACKET) &&
		(iso_full_len != packet->len)) \|\|
		((boundary_flag == HCI_ISO_BF_FIRST_FRAGMENTED_PACKET) &&
		(iso_full_len <= packet->len))) {
		LOG_ERROR("%s corrupted ISO frame", __func__);
		return;
		}
		@@ -324,6 +326,18 @@ static void reassemble_and_dispatch_iso(UNUSED_ATTR BT_HDR* packet) {
		return;
		}

		if (partial_packet->len !=
		partial_packet->offset + packet->len - HCI_ISO_PREAMBLE_SIZE) {
		LOG_ERROR(
		"%s got last fragment, but it doesn't fill up the whole packet of "
		"size %d",
		__func__, partial_packet->len);
		buffer_allocator->free(packet);
		partial_iso_packets.erase(map_iter);
		buffer_allocator->free(partial_packet);
		return;
		}

		partial_packet->layer_specific \|= BT_ISO_HDR_OFFSET_POINTS_DATA;
		partial_packet->offset = HCI_ISO_PREAMBLE_SIZE;
		if (partial_packet->layer_specific & BT_ISO_HDR_CONTAINS_TS)