Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6f987b1 authored by Automerger Merge Worker's avatar Automerger Merge Worker
Browse files

Merge "Revert "Fix potential OOB write in... 

Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"" into oc-dev am: f07200a3 am: c6967e4c

Change-Id: I22fb89a33d6265470d4dc82a19d3ff66ce1ad9fa
parents 71c28b55 c6967e4c

system/stack/btm/btm_acl.cc

+1 −17
Original line number Diff line number Diff line
@@ -47,7 +47,6 @@ 
#include "device/include/interop.h"

#include "hcidefs.h"

#include "hcimsgs.h"

#include "log/log.h"

#include "l2c_int.h"

#include "osi/include/osi.h"
@@ -1063,7 +1062,7 @@ void btm_read_remote_features_complete(uint8_t* p) { 
 * Returns          void

 *

 ******************************************************************************/

void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {

void btm_read_remote_ext_features_complete(uint8_t* p) {

  tACL_CONN* p_acl_cb;

  uint8_t page_num, max_page;

  uint16_t handle;
@@ -1071,14 +1070,6 @@ void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) { 


  BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");



  if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {

    android_errorWriteLog(0x534e4554, "141552859");

    BTM_TRACE_ERROR(

        "btm_read_remote_ext_features_complete evt length too short. length=%d",

        evt_len);

    return;

  }



  ++p;

  STREAM_TO_UINT16(handle, p);

  STREAM_TO_UINT8(page_num, p);
@@ -1098,13 +1089,6 @@ void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) { 
    return;

  }



  if (page_num > max_page) {

    android_errorWriteLog(0x534e4554, "141552859");

    BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",

                    page_num);

    return;

  }



  p_acl_cb = &btm_cb.acl_db[acl_idx];



  /* Copy the received features page */

system/stack/btm/btm_int.h

+1 −1
Original line number Diff line number Diff line
@@ -117,7 +117,7 @@ extern uint16_t btm_get_acl_disc_reason_code(void); 
extern tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr,

                                  tBT_TRANSPORT transport);

extern void btm_read_remote_features_complete(uint8_t* p);

extern void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len);

extern void btm_read_remote_ext_features_complete(uint8_t* p);

extern void btm_read_remote_ext_features_failed(uint8_t status,

                                                uint16_t handle);

extern void btm_read_remote_version_complete(uint8_t* p);

system/stack/btu/btu_hcif.cc

+4 −6
Original line number Diff line number Diff line
@@ -70,8 +70,7 @@ static void btu_hcif_authentication_comp_evt(uint8_t* p); 
static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len);

static void btu_hcif_encryption_change_evt(uint8_t* p);

static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p);

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,

                                                    uint8_t evt_len);

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p);

static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p);

static void btu_hcif_qos_setup_comp_evt(uint8_t* p);

static void btu_hcif_command_complete_evt(BT_HDR* response, void* context);
@@ -195,7 +194,7 @@ void btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_msg) { 
      btu_hcif_read_rmt_features_comp_evt(p);

      break;

    case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:

      btu_hcif_read_rmt_ext_features_comp_evt(p, hci_evt_len);

      btu_hcif_read_rmt_ext_features_comp_evt(p);

      break;

    case HCI_READ_RMT_VERSION_COMP_EVT:

      btu_hcif_read_rmt_version_comp_evt(p);
@@ -792,8 +791,7 @@ static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p) { 
 * Returns          void

 *

 ******************************************************************************/

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,

                                                    uint8_t evt_len) {

static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {

  uint8_t* p_cur = p;

  uint8_t status;

  uint16_t handle;
@@ -801,7 +799,7 @@ static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p, 
  STREAM_TO_UINT8(status, p_cur);



  if (status == HCI_SUCCESS)

    btm_read_remote_ext_features_complete(p, evt_len);

    btm_read_remote_ext_features_complete(p);

  else {

    STREAM_TO_UINT16(handle, p_cur);

    btm_read_remote_ext_features_failed(status, handle);

system/stack/include/hcidefs.h

+0 −2
Original line number Diff line number Diff line
@@ -1296,8 +1296,6 @@ typedef struct { 


#define HCI_FEATURE_BYTES_PER_PAGE 8



#define HCI_EXT_FEATURES_SUCCESS_EVT_LEN 13



#define HCI_FEATURES_KNOWN(x) \

  (((x)[0] | (x)[1] | (x)[2] | (x)[3] | (x)[4] | (x)[5] | (x)[6] | (x)[7]) != 0)