Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cdb39a80 authored by Hansong Zhang's avatar Hansong Zhang
Browse files

DO NOT MERGE Fix unexpected behavior in bta_dm_sdp_result 

Check the number of UUIDs from remote device

Bug: 74016921
Test: manual
Change-Id: Ia13f34578a046faf03506cfe10680dd5c93b1af6
Merged-In: I1ca1f66bfc935f5fd219e8147511bdac7d2789ef
parent 09d8dbc9

system/bta/dm/bta_dm_act.cc

+16 −5
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ 
#include <base/bind.h>

#include <base/callback.h>

#include <base/logging.h>

#include <cutils/log.h>

#include <string.h>



#include "bt_common.h"
@@ -145,6 +146,8 @@ static void bta_dm_ctrl_features_rd_cmpl_cback(tBTM_STATUS result); 
#define BTA_DM_SWITCH_DELAY_TIMER_MS 500

#endif



#define BTA_MAX_SERVICES 32



static void bta_dm_reset_sec_dev_pending(BD_ADDR remote_bd_addr);

static void bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr);

static void bta_dm_observe_results_cb(tBTM_INQ_RESULTS* p_inq, uint8_t* p_eir,
@@ -1498,7 +1501,7 @@ void bta_dm_sdp_result(tBTA_DM_MSG* p_data) { 
  tBT_UUID service_uuid;



  uint32_t num_uuids = 0;

  uint8_t uuid_list[32][MAX_UUID_SIZE];  // assuming a max of 32 services

  uint8_t uuid_list[BTA_MAX_SERVICES][MAX_UUID_SIZE];  // assuming a max of 32 services



  if ((p_data->sdp_event.sdp_result == SDP_SUCCESS) ||

      (p_data->sdp_event.sdp_result == SDP_NO_RECS_MATCH) ||
@@ -1566,8 +1569,12 @@ void bta_dm_sdp_result(tBTA_DM_MSG* p_data) { 
                bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index -

                                                1];

            /* Add to the list of UUIDs */

            if (num_uuids < BTA_MAX_SERVICES) {

              sdpu_uuid16_to_uuid128(tmp_svc, uuid_list[num_uuids]);

              num_uuids++;

            } else {

              android_errorWriteLog(0x534e4554, "74016921");

            }

          }

        }

      }
@@ -1599,8 +1606,12 @@ void bta_dm_sdp_result(tBTA_DM_MSG* p_data) { 
            SDP_FindServiceInDb_128bit(bta_dm_search_cb.p_sdp_db, p_sdp_rec);

        if (p_sdp_rec) {

          if (SDP_FindServiceUUIDInRec_128bit(p_sdp_rec, &temp_uuid)) {

            if (num_uuids < BTA_MAX_SERVICES) {

              memcpy(uuid_list[num_uuids], temp_uuid.uu.uuid128, MAX_UUID_SIZE);

              num_uuids++;

            } else {

              android_errorWriteLog(0x534e4554, "74016921");

            }

          }

        }

      } while (p_sdp_rec);