Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fee8a92b authored by android-build-team Robot's avatar android-build-team Robot
Browse files

Merge cherrypicks of [6072697, 6072075, 6072758, 6072124, 6072885, 6072886,... 

Merge cherrypicks of [6072697, 6072075, 6072758, 6072124, 6072885, 6072886, 6072887, 6072580, 6072581, 6072582, 6072583, 6072584, 6072132, 6072195, 6072133, 6072077, 6072134, 6072078, 6072211, 6072762, 6072763, 6072908, 6072909, 6072910, 6072911, 6072912, 6072913, 6072914, 6072930, 6072212, 6072743] into pi-qpr2-release

Change-Id: Id793360e2640b37b6708c97596bc27929320e1ff
parents 5b8bd242 0cda81e3

system/stack/l2cap/l2c_fcr.cc

+12 −2
Original line number Diff line number Diff line
@@ -833,7 +833,16 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
  }



  if (p_ccb->is_first_seg) {

    if (p_buf->len < sizeof(sdu_length)) {

      L2CAP_TRACE_ERROR("%s: buffer length=%d too small. Need at least 2.",

                        __func__, p_buf->len);

      android_errorWriteWithInfoLog(0x534e4554, "120665616", -1, NULL, 0);

      /* Discard the buffer */

      osi_free(p_buf);

      return;

    }

    STREAM_TO_UINT16(sdu_length, p);



    /* Check the SDU Length with local MTU size */

    if (sdu_length > p_ccb->local_conn_cfg.mtu) {

      /* Discard the buffer */
@@ -841,6 +850,9 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
      return;

    }



    p_buf->len -= sizeof(sdu_length);

    p_buf->offset += sizeof(sdu_length);



    if (sdu_length < p_buf->len) {

      L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);

      android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);
@@ -859,8 +871,6 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
    p_data->len = 0;

    p_ccb->ble_sdu_length = sdu_length;

    L2CAP_TRACE_DEBUG("%s SDU Length = %d", __func__, sdu_length);

    p_buf->len -= sizeof(sdu_length);

    p_buf->offset += sizeof(sdu_length);

    p_data->offset = 0;



  } else {