Commit: 7f4f039eacd819e74746258252233b4fe0c18c4b - system-bt (git)

system/bt

Commit MetaInfo

• Revision: 7f4f039eacd819e74746258252233b4fe0c18c4b (tree)
• Zeit: 2020-02-11 11:03:14
• Autor: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Log Message

Android 9.0.0 Release 53 (6107734)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXji5JAAKCRDorT+BmrEO
eJboAKCSe9P52YLnIX6VnMmDDDsqg903CACffCK0Mg8A9OqfA8/j+eSXd1PLC1k=
=XSWP
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r53' into pie-x86

Android 9.0.0 Release 53 (6107734)

Ändern Zusammenfassung

• modified: hci/src/packet_fragmenter.cc
• modified: stack/btm/btm_acl.cc
• modified: stack/btm/btm_int.h
• modified: stack/btu/btu_hcif.cc
• modified: stack/include/hcidefs.h
• modified: stack/sdp/sdp_discovery.cc

Diff

--- a/hci/src/packet_fragmenter.cc
+++ b/hci/src/packet_fragmenter.cc
@@ -216,7 +216,8 @@ static void reassemble_and_dispatch(UNUSED_ATTR BT_HDR* packet) {
                  "%s got packet which would exceed expected length of %d. "
                  "Truncating.",
                  __func__, partial_packet->len);
-        packet->len = partial_packet->len - partial_packet->offset;
+        packet->len =
+            (partial_packet->len - partial_packet->offset) + packet->offset;
         projected_offset = partial_packet->len;
       }
 

--- a/stack/btm/btm_acl.cc
+++ b/stack/btm/btm_acl.cc
@@ -1089,7 +1089,7 @@ void btm_read_remote_features_complete(uint8_t* p) {
  * Returns          void
  *
  ******************************************************************************/
-void btm_read_remote_ext_features_complete(uint8_t* p) {
+void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
   tACL_CONN* p_acl_cb;
   uint8_t page_num, max_page;
   uint16_t handle;
@@ -1097,6 +1097,14 @@ void btm_read_remote_ext_features_complete(uint8_t* p) {
 
   BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
 
+  if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
+    android_errorWriteLog(0x534e4554, "141552859");
+    BTM_TRACE_ERROR(
+        "btm_read_remote_ext_features_complete evt length too short. length=%d",
+        evt_len);
+    return;
+  }
+
   ++p;
   STREAM_TO_UINT16(handle, p);
   STREAM_TO_UINT8(page_num, p);
@@ -1116,6 +1124,19 @@ void btm_read_remote_ext_features_complete(uint8_t* p) {
     return;
   }
 
+  if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
+    android_errorWriteLog(0x534e4554, "141552859");
+    BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
+                    page_num);
+    return;
+  }
+
+  if (page_num > max_page) {
+    BTM_TRACE_WARNING(
+        "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
+        "invalid", page_num, max_page);
+  }
+
   p_acl_cb = &btm_cb.acl_db[acl_idx];
 
   /* Copy the received features page */

--- a/stack/btm/btm_int.h
+++ b/stack/btm/btm_int.h
@@ -118,7 +118,7 @@ extern uint16_t btm_get_acl_disc_reason_code(void);
 extern tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr,
                                   tBT_TRANSPORT transport);
 extern void btm_read_remote_features_complete(uint8_t* p);
-extern void btm_read_remote_ext_features_complete(uint8_t* p);
+extern void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len);
 extern void btm_read_remote_ext_features_failed(uint8_t status,
                                                 uint16_t handle);
 extern void btm_read_remote_version_complete(uint8_t* p);

--- a/stack/btu/btu_hcif.cc
+++ b/stack/btu/btu_hcif.cc
@@ -71,7 +71,8 @@ static void btu_hcif_authentication_comp_evt(uint8_t* p);
 static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len);
 static void btu_hcif_encryption_change_evt(uint8_t* p);
 static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p);
-static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p);
+static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
+                                                    uint8_t evt_len);
 static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p);
 static void btu_hcif_qos_setup_comp_evt(uint8_t* p);
 static void btu_hcif_command_complete_evt(BT_HDR* response, void* context);
@@ -195,7 +196,7 @@ void btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_msg) {
       btu_hcif_read_rmt_features_comp_evt(p);
       break;
     case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:
-      btu_hcif_read_rmt_ext_features_comp_evt(p);
+      btu_hcif_read_rmt_ext_features_comp_evt(p, hci_evt_len);
       break;
     case HCI_READ_RMT_VERSION_COMP_EVT:
       btu_hcif_read_rmt_version_comp_evt(p);
@@ -812,7 +813,8 @@ static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p) {
  * Returns          void
  *
  ******************************************************************************/
-static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {
+static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
+                                                    uint8_t evt_len) {
   uint8_t* p_cur = p;
   uint8_t status;
   uint16_t handle;
@@ -820,7 +822,7 @@ static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {
   STREAM_TO_UINT8(status, p_cur);
 
   if (status == HCI_SUCCESS)
-    btm_read_remote_ext_features_complete(p);
+    btm_read_remote_ext_features_complete(p, evt_len);
   else {
     STREAM_TO_UINT16(handle, p_cur);
     btm_read_remote_ext_features_failed(status, handle);

--- a/stack/include/hcidefs.h
+++ b/stack/include/hcidefs.h
@@ -1322,6 +1322,8 @@ typedef struct {
 
 #define HCI_FEATURE_BYTES_PER_PAGE 8
 
+#define HCI_EXT_FEATURES_SUCCESS_EVT_LEN 13
+
 #define HCI_FEATURES_KNOWN(x) \
   (((x)[0] | (x)[1] | (x)[2] | (x)[3] | (x)[4] | (x)[5] | (x)[6] | (x)[7]) != 0)
 

--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -474,6 +474,7 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
       if (!sdp_copy_raw_data(p_ccb, false)) {
         SDP_TRACE_ERROR("sdp_copy_raw_data failed");
         sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
+        return;
       }
 
 #endif
@@ -703,6 +704,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
   if (!sdp_copy_raw_data(p_ccb, true)) {
     SDP_TRACE_ERROR("sdp_copy_raw_data failed");
     sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
+    return;
   }
 #endif