Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6967e4c authored by Automerger Merge Worker's avatar Automerger Merge Worker
Browse files

Merge "Revert "Fix potential OOB write in... 

Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"" into oc-dev am: f07200a3

Change-Id: I2cc0a9befe3c2b0412d53bad6b7790e61119cae2
parents 2d060239 f07200a3

system/stack/btm/btm_acl.cc

+1 −17
Original line number Diff line number Diff line
@@ -47,7 +47,6 @@ 
#include "device/include/interop.h"

#include "hcidefs.h"

#include "hcimsgs.h"

#include "log/log.h"

#include "l2c_int.h"

#include "osi/include/osi.h"
@@ -1077,7 +1076,7 @@ void btm_read_remote_features_complete(uint8_t* p) { 
 * Returns          void

 *

 ******************************************************************************/

void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {

void btm_read_remote_ext_features_complete(uint8_t* p) {

  tACL_CONN* p_acl_cb;

  uint8_t page_num, max_page;

  uint16_t handle;
@@ -1085,14 +1084,6 @@ void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) { 


  BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");



  if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {

    android_errorWriteLog(0x534e4554, "141552859");

    BTM_TRACE_ERROR(

        "btm_read_remote_ext_features_complete evt length too short. length=%d",

        evt_len);

    return;

  }



  ++p;

  STREAM_TO_UINT16(handle, p);

  STREAM_TO_UINT8(page_num, p);
@@ -1112,13 +1103,6 @@ void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) { 
    return;

  }



  if (page_num > max_page) {

    android_errorWriteLog(0x534e4554, "141552859");

    BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",

                    page_num);

    return;

  }



  p_acl_cb = &btm_cb.acl_db[acl_idx];



  /* Copy the received features page */

system/stack/btm/btm_int.h

+1 −1
Original line number Diff line number Diff line
@@ -112,7 +112,7 @@ extern void btm_acl_encrypt_change(uint16_t handle, uint8_t status, 
extern uint16_t btm_get_acl_disc_reason_code(void);

extern tBTM_STATUS btm_remove_acl(BD_ADDR bd_addr, tBT_TRANSPORT transport);

extern void btm_read_remote_features_complete(uint8_t* p);

extern void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len);

extern void btm_read_remote_ext_features_complete(uint8_t* p);

extern void btm_read_remote_ext_features_failed(uint8_t status,

                                                uint16_t handle);

extern void btm_read_remote_version_complete(uint8_t* p);

system/stack/btu/btu_hcif.cc

+4 −6
Original line number Diff line number Diff line
@@ -69,8 +69,7 @@ static void btu_hcif_authentication_comp_evt(uint8_t* p); 
static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len);

static void btu_hcif_encryption_change_evt(uint8_t* p);

static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p);

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,

                                                    uint8_t evt_len);

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p);

static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p);

static void btu_hcif_qos_setup_comp_evt(uint8_t* p);

static void btu_hcif_command_complete_evt(BT_HDR* response, void* context);
@@ -194,7 +193,7 @@ void btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_msg) { 
      btu_hcif_read_rmt_features_comp_evt(p);

      break;

    case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:

      btu_hcif_read_rmt_ext_features_comp_evt(p, hci_evt_len);

      btu_hcif_read_rmt_ext_features_comp_evt(p);

      break;

    case HCI_READ_RMT_VERSION_COMP_EVT:

      btu_hcif_read_rmt_version_comp_evt(p);
@@ -750,8 +749,7 @@ static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p) { 
 * Returns          void

 *

 ******************************************************************************/

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,

                                                    uint8_t evt_len) {

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {

  uint8_t* p_cur = p;

  uint8_t status;

  uint16_t handle;
@@ -759,7 +757,7 @@ static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p, 
  STREAM_TO_UINT8(status, p_cur);



  if (status == HCI_SUCCESS)

    btm_read_remote_ext_features_complete(p, evt_len);

    btm_read_remote_ext_features_complete(p);

  else {

    STREAM_TO_UINT16(handle, p_cur);

    btm_read_remote_ext_features_failed(status, handle);

system/stack/include/hcidefs.h

+0 −2
Original line number Diff line number Diff line
@@ -1567,8 +1567,6 @@ typedef struct { 


#define HCI_FEATURE_BYTES_PER_PAGE 8



#define HCI_EXT_FEATURES_SUCCESS_EVT_LEN 13



#define HCI_FEATURES_KNOWN(x) \

  (((x)[0] | (x)[1] | (x)[2] | (x)[3] | (x)[4] | (x)[5] | (x)[6] | (x)[7]) != 0)