Commit: 771973450c41b71b6fc590f17d00b1edcd5fcde6 - system-bt (git)

system/bt

Commit MetaInfo

• Revision: 771973450c41b71b6fc590f17d00b1edcd5fcde6 (tree)
• Time: 2020-01-20 19:51:15
• Author: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Log Message

Android 9.0.0 release 52
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXhOwsgAKCRDorT+BmrEO
eDoxAJ44V2t/Tt+GwLDRNqBNt2BJqppEnQCfZ26WzmibtVcI0EdiML9JFs3DnZI=
=LQYB
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r52' into pie-x86

Android 9.0.0 release 52

Change Summary

• modified: bta/av/bta_av_aact.cc
• modified: btcore/src/device_class.cc
• modified: btcore/test/device_class_test.cc
• modified: btif/src/btif_dm.cc
• modified: service/low_energy_client.cc
• modified: stack/sdp/sdp_discovery.cc

Incremental Difference

--- a/bta/av/bta_av_aact.cc
+++ b/bta/av/bta_av_aact.cc
@@ -3057,14 +3057,14 @@ void bta_av_open_at_inc(tBTA_AV_SCB* p_scb, tBTA_AV_DATA* p_data) {
 }
 
 void offload_vendor_callback(tBTM_VSC_CMPL* param) {
-  uint8_t status = 0;
+  tBTA_AV value{0};
   uint8_t sub_opcode = 0;
   if (param->param_len) {
     APPL_TRACE_DEBUG("%s: param_len = %d status = %d", __func__,
                      param->param_len, param->p_param_buf[0]);
-    status = param->p_param_buf[0];
+    value.status = param->p_param_buf[0];
   }
-  if (status == 0) {
+  if (value.status == 0) {
     sub_opcode = param->p_param_buf[1];
     APPL_TRACE_DEBUG("%s: subopcode = %d", __func__, sub_opcode);
     switch (sub_opcode) {
@@ -3072,7 +3072,7 @@ void offload_vendor_callback(tBTM_VSC_CMPL* param) {
         APPL_TRACE_DEBUG("%s: VS_HCI_STOP_A2DP_MEDIA successful", __func__);
         break;
       case VS_HCI_A2DP_OFFLOAD_START:
-        (*bta_av_cb.p_cback)(BTA_AV_OFFLOAD_START_RSP_EVT, (tBTA_AV*)&status);
+        (*bta_av_cb.p_cback)(BTA_AV_OFFLOAD_START_RSP_EVT, &value);
         break;
       default:
         break;
@@ -3081,7 +3081,7 @@ void offload_vendor_callback(tBTM_VSC_CMPL* param) {
     APPL_TRACE_DEBUG("%s: Offload failed for subopcode= %d", __func__,
                      sub_opcode);
     if (param->opcode != VS_HCI_A2DP_OFFLOAD_STOP)
-      (*bta_av_cb.p_cback)(BTA_AV_OFFLOAD_START_RSP_EVT, (tBTA_AV*)&status);
+      (*bta_av_cb.p_cback)(BTA_AV_OFFLOAD_START_RSP_EVT, &value);
   }
 }
 

--- a/btcore/src/device_class.cc
+++ b/btcore/src/device_class.cc
@@ -88,7 +88,9 @@ void device_class_from_int(bt_device_class_t* dc, int data) {
 int device_class_to_int(const bt_device_class_t* dc) {
   CHECK(dc != NULL);
   // Careful with endianess.
-  return (int)(le32toh(*(int*)dc) & 0xffffff);
+  int val = 0;
+  memcpy(&val, dc, sizeof(*dc));
+  return static_cast<int>(le32toh(val) & 0xffffff);
 }
 
 bool device_class_equals(const bt_device_class_t* p1,

--- a/btcore/test/device_class_test.cc
+++ b/btcore/test/device_class_test.cc
@@ -22,9 +22,6 @@
 
 #include "btcore/include/device_class.h"
 
-// Device Class is 3 bytes.
-static const int DC_MASK = 0xffffff;
-
 ::testing::AssertionResult check_bitfield(const char* m_expr,
                                           const char* n_expr, int m, int n) {
   if (m == n) return ::testing::AssertionSuccess();
@@ -84,8 +81,9 @@ TEST_F(DeviceClassTest, to_stream) {
     int rc = device_class_to_stream(&dc, dc_stream1, sizeof(dc_stream1));
     EXPECT_EQ(3, rc);
 
-    uint32_t* val = (uint32_t*)&dc;
-    EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, *val & 0xffffff);
+    uint32_t val = 0;
+    memcpy(&val, &dc, sizeof(dc));
+    EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, val);
 
     EXPECT_PRED_FORMAT2(check_bitfield, 0x00, dc_stream1[0]);
     EXPECT_PRED_FORMAT2(check_bitfield, 0x00, dc_stream1[1]);
@@ -101,8 +99,9 @@ TEST_F(DeviceClassTest, to_stream) {
 
     int rc = device_class_to_stream(&dc, dc_stream1, sizeof(dc_stream1));
     EXPECT_EQ(3, rc);
-    uint32_t* val = (uint32_t*)&dc;
-    EXPECT_PRED_FORMAT2(check_bitfield, 0x00aa55aa, *val & 0xffffff);
+    uint32_t val = 0;
+    memcpy(&val, &dc, sizeof(dc));
+    EXPECT_PRED_FORMAT2(check_bitfield, 0x00aa55aa, val);
 
     EXPECT_PRED_FORMAT2(check_bitfield, 0xaa, dc_stream1[0]);
     EXPECT_PRED_FORMAT2(check_bitfield, 0x55, dc_stream1[1]);
@@ -118,8 +117,9 @@ TEST_F(DeviceClassTest, to_stream) {
 
     int rc = device_class_to_stream(&dc, dc_stream1, sizeof(dc_stream1));
     EXPECT_EQ(3, rc);
-    uint32_t* val = (uint32_t*)&dc;
-    EXPECT_PRED_FORMAT2(check_bitfield, 0x452301, *val & 0xffffff);
+    uint32_t val = 0;
+    memcpy(&val, &dc, sizeof(dc));
+    EXPECT_PRED_FORMAT2(check_bitfield, 0x452301, val);
 
     EXPECT_PRED_FORMAT2(check_bitfield, 0x01, dc_stream1[0]);
     EXPECT_PRED_FORMAT2(check_bitfield, 0x23, dc_stream1[1]);
@@ -131,24 +131,33 @@ TEST_F(DeviceClassTest, limited_discoverable_mode) {
   uint8_t dc_stream[] = {0x00, 0x00, 0x00};
   bt_device_class_t dc;
   device_class_from_stream(&dc, dc_stream);
-  uint32_t* test = (uint32_t*)&dc;
+  uint32_t test = 0;
+  memcpy(&test, &dc, sizeof(dc));
 
   EXPECT_FALSE(device_class_get_limited(&dc));
-  EXPECT_EQ((unsigned)0x00000000, *test & DC_MASK);
+  EXPECT_EQ((unsigned)0x00000000, test);
 
   device_class_set_limited(&dc, true);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
   EXPECT_TRUE(device_class_get_limited(&dc));
-  EXPECT_EQ((unsigned)0x00002000, *test & DC_MASK);
+  EXPECT_EQ((unsigned)0x00002000, test);
 
   device_class_set_limited(&dc, false);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
   EXPECT_FALSE(device_class_get_limited(&dc));
-  EXPECT_EQ((unsigned)0x00000000, *test & DC_MASK);
+  EXPECT_EQ((unsigned)0x00000000, test);
 
   device_class_set_limited(&dc, true);
-  EXPECT_PRED_FORMAT2(check_bitfield, 0x00002000, *test & DC_MASK);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
+  EXPECT_PRED_FORMAT2(check_bitfield, 0x00002000, test);
 
   device_class_set_limited(&dc, false);
-  EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, *test & DC_MASK);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
+  EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, test);
 }
 
 TEST_F(DeviceClassTest, equals) {

--- a/btif/src/btif_dm.cc
+++ b/btif/src/btif_dm.cc
@@ -965,21 +965,12 @@ static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ* p_ssp_cfm_req) {
 
   /* If JustWorks auto-accept */
   if (p_ssp_cfm_req->just_works) {
-    /* Pairing consent for JustWorks needed if:
-     * 1. Incoming (non-temporary) pairing is detected AND
-     * 2. local IO capabilities are DisplayYesNo AND
-     * 3. remote IO capabiltiies are DisplayOnly or NoInputNoOutput;
+    /* Pairing consent for JustWorks NOT needed if:
+     * 1. Incoming temporary pairing is detected
      */
-    if (is_incoming && pairing_cb.bond_type != BOND_TYPE_TEMPORARY &&
-        ((p_ssp_cfm_req->loc_io_caps == HCI_IO_CAP_DISPLAY_YESNO) &&
-         (p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_DISPLAY_ONLY ||
-          p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_NO_IO))) {
+    if (is_incoming && pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
       BTIF_TRACE_EVENT(
-          "%s: User consent needed for incoming pairing request. loc_io_caps: "
-          "%d, rmt_io_caps: %d",
-          __func__, p_ssp_cfm_req->loc_io_caps, p_ssp_cfm_req->rmt_io_caps);
-    } else {
-      BTIF_TRACE_EVENT("%s: Auto-accept JustWorks pairing", __func__);
+          "%s: Auto-accept JustWorks pairing for temporary incoming", __func__);
       btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, true, 0);
       return;
     }

--- a/service/low_energy_client.cc
+++ b/service/low_energy_client.cc
@@ -188,8 +188,8 @@ void LowEnergyClient::MtuChangedCallback(
 
   if (!bda) return;
 
-  const char* addr = BtAddrString(bda).c_str();
-  if (delegate_) delegate_->OnMtuChanged(this, status, addr, mtu);
+  std::string addr = BtAddrString(bda);
+  if (delegate_) delegate_->OnMtuChanged(this, status, addr.c_str(), mtu);
 }
 
 // LowEnergyClientFactory implementation

--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -341,11 +341,13 @@ static void process_service_search_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
  * Description      copy the raw data
  *
  *
- * Returns          void
+ * Returns          bool
+ *                          true if successful
+ *                          false if not copied
  *
  ******************************************************************************/
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
-static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
+static bool sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
   unsigned int cpy_len, rem_len;
   uint32_t list_len;
   uint8_t* p;
@@ -376,11 +378,11 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
       p = sdpu_get_len_from_type(p, p_end, type, &list_len);
       if (p == NULL || (p + list_len) > p_end) {
         SDP_TRACE_WARNING("%s: bad length", __func__);
-        return;
+        return false;
       }
       if ((int)cpy_len < (p - old_p)) {
         SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
-        return;
+        return false;
       }
       cpy_len -= (p - old_p);
     }
@@ -400,6 +402,7 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
     memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
     p_ccb->p_db->raw_used += cpy_len;
   }
+  return true;
 }
 #endif
 
@@ -468,7 +471,11 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
     } else {
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
       SDP_TRACE_WARNING("process_service_attr_rsp");
-      sdp_copy_raw_data(p_ccb, false);
+      if (!sdp_copy_raw_data(p_ccb, false)) {
+        SDP_TRACE_ERROR("sdp_copy_raw_data failed");
+        sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
+      }
+
 #endif
 
       /* Save the response in the database. Stop on any error */
@@ -693,7 +700,10 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
 
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
   SDP_TRACE_WARNING("process_service_search_attr_rsp");
-  sdp_copy_raw_data(p_ccb, true);
+  if (!sdp_copy_raw_data(p_ccb, true)) {
+    SDP_TRACE_ERROR("sdp_copy_raw_data failed");
+    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
+  }
 #endif
 
   p = &p_ccb->rsp_list[0];
@@ -708,6 +718,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
   p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
   if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
     SDP_TRACE_WARNING("%s: bad length", __func__);
+    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
     return;
   }
   p_end = &p_ccb->rsp_list[p_ccb->list_len];