Merge cherrypicks of ['googleplex-android-review.googlesource.com/23252652'] into udc-release. (e78ab5e6) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/gatt/gatt_sr.cc

+17 −15

Original line number	Original line	Diff line number	Diff line
	@@ -21,6 +21,7 @@
	* this file contains the GATT server functions		* this file contains the GATT server functions
	*		*
	******************************************************************************/		******************************************************************************/
			#include <algorithm>
	#include <string.h>		#include <string.h>

	#include "bt_target.h"		#include "bt_target.h"
	@@ -179,37 +180,38 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
	}		}

	if (p_rsp != NULL) {		if (p_rsp != NULL) {
	total_len = (p_buf->len + p_rsp->attr_value.len);		total_len = p_buf->len;
	if (p_cmd->multi_req.variable_len) {		if (p_cmd->multi_req.variable_len) {
	total_len += 2;		total_len += 2;
	}		}

	if (total_len > mtu) {		if (total_len > mtu) {
	/* just send the partial response for the overflow case */		VLOG(1) << "Buffer space not enough for this data item, skipping";
	len = p_rsp->attr_value.len - (total_len - mtu);		break;
			}

			len = std::min((size_t) p_rsp->attr_value.len, mtu - total_len);

			if (len == 0) {
			VLOG(1) << "Buffer space not enough for this data item, skipping";
			break;
			}

			if (len < p_rsp->attr_value.len) {
	is_overflow = true;		is_overflow = true;
	VLOG(1) << StringPrintf(		VLOG(1) << StringPrintf(
	"multi read overflow available len=%zu val_len=%d", len,		"multi read overflow available len=%zu val_len=%d", len,
	p_rsp->attr_value.len);		p_rsp->attr_value.len);
	} else {
	len = p_rsp->attr_value.len;
	}		}

	if (p_cmd->multi_req.variable_len) {		if (p_cmd->multi_req.variable_len) {
	UINT16_TO_STREAM(p, len);		UINT16_TO_STREAM(p, (uint16_t) len);
	p_buf->len += 2;		p_buf->len += 2;
	}		}

	if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {		if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
	// check for possible integer overflow		ARRAY_TO_STREAM(p, p_rsp->attr_value.value, (uint16_t) len);
	if (p_buf->len + len <= UINT16_MAX) {		p_buf->len += (uint16_t) len;
	memcpy(p, p_rsp->attr_value.value, len);
	if (!is_overflow) p += len;
	p_buf->len += len;
	} else {
	p_cmd->status = GATT_NOT_FOUND;
	break;
	}
	} else {		} else {
	p_cmd->status = GATT_NOT_FOUND;		p_cmd->status = GATT_NOT_FOUND;
	break;		break;