提交: 200dfcc9948b7f6a0939b528dd731f7eb5bfc25a - system-bt (git)

system/bt

Commit MetaInfo

• 修订版: 200dfcc9948b7f6a0939b528dd731f7eb5bfc25a (tree)
• 时间: 2018-05-02 23:45:38
• 作者: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Log Message

Merge remote-tracking branch 'cm/cm-14.1' into cm-14.1-x86

更改概述

• modified: audio_a2dp_hw/bthost_ipc.c
• modified: bta/pan/bta_pan_act.c
• modified: osi/src/alarm.c
• modified: osi/src/config.c
• modified: stack/avrc/avrc_pars_ct.c
• modified: stack/avrc/avrc_pars_tg.c
• modified: stack/bnep/bnep_main.c
• modified: stack/bnep/bnep_utils.c
• modified: stack/btu/btu_init.c
• modified: stack/sdp/sdp_discovery.c
• modified: stack/sdp/sdp_main.c
• modified: stack/sdp/sdp_server.c
• modified: stack/sdp/sdp_utils.c
• modified: stack/sdp/sdpint.h
• modified: stack/smp/smp_utils.c

差异

--- a/audio_a2dp_hw/bthost_ipc.c
+++ b/audio_a2dp_hw/bthost_ipc.c
@@ -198,7 +198,7 @@ static void* a2dp_codec_parser(uint8_t *codec_cfg, audio_format_t *codec_type)
                  sbc_codec.sampling_rate = 44100;
                  break;
             case A2D_SBC_SAMP_FREQ_32:
-                 sbc_codec.sampling_rate = 3200;
+                 sbc_codec.sampling_rate = 32000;
                  break;
             case A2D_SBC_SAMP_FREQ_16:
                  sbc_codec.sampling_rate = 16000;

--- a/bta/pan/bta_pan_act.c
+++ b/bta/pan/bta_pan_act.c
@@ -176,6 +176,11 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
     tBTA_PAN_SCB *p_scb;
     BT_HDR *p_new_buf;
 
+    p_scb = bta_pan_scb_by_handle(handle);
+    if (p_scb == NULL) {
+        return;
+    }
+
     if (sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset) {
         /* offset smaller than data structure in front of actual data */
         if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
@@ -183,7 +188,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
             android_errorWriteLog(0x534e4554, "63146237");
             APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
                              p_buf->len);
-            osi_free(p_buf);
             return;
         }
         p_new_buf = (BT_HDR *)osi_malloc(PAN_BUF_SIZE);
@@ -191,7 +195,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
                (UINT8 *)(p_buf + 1) + p_buf->offset, p_buf->len);
         p_new_buf->len    = p_buf->len;
         p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);
-        osi_free(p_buf);
     } else {
         p_new_buf = p_buf;
     }
@@ -202,11 +205,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
     ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->ext = ext;
     ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->forward = forward;
 
-    if ((p_scb = bta_pan_scb_by_handle(handle)) == NULL) {
-        osi_free(p_new_buf);
-        return;
-    }
-
     fixed_queue_enqueue(p_scb->data_queue, p_new_buf);
     BT_HDR *p_event = (BT_HDR *)osi_malloc(sizeof(BT_HDR));
     p_event->layer_specific = handle;

--- a/osi/src/alarm.c
+++ b/osi/src/alarm.c
@@ -64,7 +64,6 @@ typedef struct {
   size_t rescheduled_count;
   size_t total_updates;
   period_ms_t last_update_ms;
-  stat_t callback_execution;
   stat_t overdue_scheduling;
   stat_t premature_scheduling;
 } alarm_stats_t;
@@ -134,8 +133,7 @@ static void callback_dispatch(void *context);
 static bool timer_create_internal(const clockid_t clock_id, timer_t *timer);
 static void update_scheduling_stats(alarm_stats_t *stats,
                                     period_ms_t now_ms,
-                                    period_ms_t deadline_ms,
-                                    period_ms_t execution_delta_ms);
+                                    period_ms_t deadline_ms);
 
 static void update_stat(stat_t *stat, period_ms_t delta)
 {
@@ -613,14 +611,12 @@ static void alarm_queue_ready(fixed_queue_t *queue,
   pthread_mutex_lock(&alarm->callback_lock);
   pthread_mutex_unlock(&monitor);
 
-  period_ms_t t0 = now();
-  callback(data);
-  period_ms_t t1 = now();
-
   // Update the statistics
-  assert(t1 >= t0);
-  period_ms_t delta = t1 - t0;
-  update_scheduling_stats(&alarm->stats, t0, deadline, delta);
+  update_scheduling_stats(&alarm->stats, now(), deadline);
+
+  // NOTE: Do NOT access "alarm" after the callback, as a safety precaution
+  // in case the callback itself deleted the alarm.
+  callback(data);
 
   pthread_mutex_unlock(&alarm->callback_lock);
 }
@@ -694,14 +690,11 @@ static bool timer_create_internal(const clockid_t clock_id, timer_t *timer) {
 
 static void update_scheduling_stats(alarm_stats_t *stats,
                                     period_ms_t now_ms,
-                                    period_ms_t deadline_ms,
-                                    period_ms_t execution_delta_ms)
+                                    period_ms_t deadline_ms)
 {
   stats->total_updates++;
   stats->last_update_ms = now_ms;
 
-  update_stat(&stats->callback_execution, execution_delta_ms);
-
   if (deadline_ms < now_ms) {
     // Overdue scheduling
     period_ms_t delta_ms = now_ms - deadline_ms;
@@ -754,7 +747,7 @@ void alarm_debug_dump(int fd)
     dprintf(fd, "%-51s: %zu / %zu / %zu / %zu\n",
             "    Action counts (sched/resched/exec/cancel)",
             stats->scheduled_count, stats->rescheduled_count,
-            stats->callback_execution.count, stats->canceled_count);
+            stats->total_updates, stats->canceled_count);
 
     dprintf(fd, "%-51s: %zu / %zu\n",
             "    Deviation counts (overdue/premature)",
@@ -767,9 +760,6 @@ void alarm_debug_dump(int fd)
             (unsigned long long) alarm->period,
             (long long)(alarm->deadline - just_now));
 
-    dump_stat(fd, &stats->callback_execution,
-              "    Callback execution time in ms (total/max/avg)");
-
     dump_stat(fd, &stats->overdue_scheduling,
               "    Overdue scheduling time in ms (total/max/avg)");
 

--- a/osi/src/config.c
+++ b/osi/src/config.c
@@ -34,6 +34,7 @@
 #include "osi/include/allocator.h"
 #include "osi/include/list.h"
 #include "osi/include/log.h"
+#include "log/log.h"
 
 typedef struct {
   char *key;
@@ -221,16 +222,36 @@ void config_set_string(config_t *config, const char *section, const char *key, c
   }
 
   if (sec) {
+    char *value_string = (char *)value;
+    char *value_no_newline;
+    char *newline = strstr(value_string, "\n");
+    if (newline) {
+      android_errorWriteLog(0x534e4554, "70808273");
+      size_t newline_pos = newline - value_string;
+      value_no_newline = osi_strndup(value_string, newline_pos);
+      if (!value_no_newline) {
+        LOG_ERROR(LOG_TAG,"%s: Unable to allocate memory for value_no_newline", __func__);
+        return;
+      }
+    } else {
+      value_no_newline = value_string;
+    }
     for (const list_node_t *node = list_begin(sec->entries); node != list_end(sec->entries); node = list_next(node)) {
       entry_t *entry = list_node(node);
       if (!strcmp(entry->key, key)) {
         osi_free(entry->value);
-        entry->value = osi_strdup(value);
+        entry->value = osi_strdup(value_no_newline);
+        if (newline) {
+          osi_free(value_no_newline);
+        }
         return;
       }
     }
 
-    entry_t *entry = entry_new(key, value);
+    entry_t *entry = entry_new(key, value_no_newline);
+    if (newline) {
+      osi_free(value_no_newline);
+    }
     list_append(sec->entries, entry);
   }
 }

--- a/stack/avrc/avrc_pars_ct.c
+++ b/stack/avrc/avrc_pars_ct.c
@@ -22,6 +22,7 @@
 #include "avrc_defs.h"
 #include "avrc_int.h"
 #include "bt_utils.h"
+#include "log/log.h"
 
 /*****************************************************************************
 **  Global data
@@ -227,6 +228,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
         }
         BE_STREAM_TO_UINT8(p_result->list_app_attr.num_attr, p);
         AVRC_TRACE_DEBUG("%s attr count = %d ", __func__, p_result->list_app_attr.num_attr);
+
+        if (p_result->list_app_attr.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
+            android_errorWriteLog(0x534e4554, "63146237");
+            p_result->list_app_attr.num_attr = AVRC_MAX_APP_ATTR_SIZE;
+        }
+
         for(int xx = 0; xx < p_result->list_app_attr.num_attr; xx++)
         {
             BE_STREAM_TO_UINT8(p_result->list_app_attr.attrs[xx], p);
@@ -258,6 +265,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
         tAVRC_APP_SETTING *app_sett =
             (tAVRC_APP_SETTING*)osi_malloc(p_result->get_cur_app_val.num_val*sizeof(tAVRC_APP_SETTING));
         AVRC_TRACE_DEBUG("%s attr count = %d ", __func__, p_result->get_cur_app_val.num_val);
+
+        if (p_result->get_cur_app_val.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+            android_errorWriteLog(0x534e4554, "63146237");
+            p_result->get_cur_app_val.num_val = AVRC_MAX_APP_ATTR_SIZE;
+        }
+
         for (int xx = 0; xx < p_result->get_cur_app_val.num_val; xx++)
         {
             BE_STREAM_TO_UINT8(app_sett[xx].attr_id, p);
@@ -269,7 +282,6 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
 
     case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT:
     {
-        tAVRC_APP_SETTING_TEXT   *p_setting_text;
         UINT8                    num_attrs;
 
         if (len == 0)
@@ -278,9 +290,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
             break;
         }
         BE_STREAM_TO_UINT8(num_attrs, p);
+        if (num_attrs > AVRC_MAX_APP_ATTR_SIZE) {
+            num_attrs = AVRC_MAX_APP_ATTR_SIZE;
+        }
         AVRC_TRACE_DEBUG("%s attr count = %d ", __func__, p_result->get_app_attr_txt.num_attr);
         p_result->get_app_attr_txt.num_attr = num_attrs;
-        p_setting_text = (tAVRC_APP_SETTING_TEXT*)osi_malloc(num_attrs * sizeof(tAVRC_APP_SETTING_TEXT));
+        p_result->get_app_attr_txt.p_attrs = (tAVRC_APP_SETTING_TEXT*)osi_malloc(num_attrs * sizeof(tAVRC_APP_SETTING_TEXT));
         for (int xx = 0; xx < num_attrs; xx++)
         {
             BE_STREAM_TO_UINT8(p_result->get_app_attr_txt.p_attrs[xx].attr_id, p);
@@ -300,7 +315,6 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
 
     case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT:
     {
-        tAVRC_APP_SETTING_TEXT   *p_setting_text;
         UINT8                    num_vals;
 
         if (len == 0)
@@ -309,10 +323,13 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
             break;
         }
         BE_STREAM_TO_UINT8(num_vals, p);
+        if (num_vals > AVRC_MAX_APP_ATTR_SIZE) {
+            num_vals = AVRC_MAX_APP_ATTR_SIZE;
+        }
         p_result->get_app_val_txt.num_attr = num_vals;
         AVRC_TRACE_DEBUG("%s value count = %d ", __func__, p_result->get_app_val_txt.num_attr);
 
-        p_setting_text = (tAVRC_APP_SETTING_TEXT *)osi_malloc(num_vals * sizeof(tAVRC_APP_SETTING_TEXT));
+        p_result->get_app_val_txt.p_attrs = (tAVRC_APP_SETTING_TEXT *)osi_malloc(num_vals * sizeof(tAVRC_APP_SETTING_TEXT));
         for (int i = 0; i < num_vals; i++) {
             BE_STREAM_TO_UINT8(p_result->get_app_val_txt.p_attrs[i].attr_id, p);
             BE_STREAM_TO_UINT16(p_result->get_app_val_txt.p_attrs[i].charset_id, p);

--- a/stack/avrc/avrc_pars_tg.c
+++ b/stack/avrc/avrc_pars_tg.c
@@ -21,6 +21,7 @@
 #include "avrc_api.h"
 #include "avrc_defs.h"
 #include "avrc_int.h"
+#include "log/log.h"
 
 /*****************************************************************************
 **  Global data
@@ -169,6 +170,12 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
             status = AVRC_STS_INTERNAL_ERR;
             break;
         }
+
+        if (p_result->get_cur_app_val.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
+            android_errorWriteLog(0x534e4554, "63146237");
+            p_result->get_cur_app_val.num_attr = AVRC_MAX_APP_ATTR_SIZE;
+        }
+
         p_u8 = p_result->get_cur_app_val.attrs;
         for (xx=0, yy=0; xx< p_result->get_cur_app_val.num_attr; xx++)
         {
@@ -229,6 +236,11 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_
                     status = AVRC_STS_INTERNAL_ERR;
                 else
                 {
+                    if (p_result->get_app_val_txt.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+                        android_errorWriteLog(0x534e4554, "63146237");
+                        p_result->get_app_val_txt.num_val = AVRC_MAX_APP_ATTR_SIZE;
+                    }
+
                     p_u8 = p_result->get_app_val_txt.vals;
                     for (xx=0; xx< p_result->get_app_val_txt.num_val; xx++)
                     {

--- a/stack/bnep/bnep_main.c
+++ b/stack/bnep/bnep_main.c
@@ -35,6 +35,7 @@
 
 #include "l2c_api.h"
 #include "l2cdefs.h"
+#include "log/log.h"
 
 #include "btu.h"
 #include "btm_api.h"
@@ -495,6 +496,12 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
     type = *p++;
     extension_present = type >> 7;
     type &= 0x7f;
+    if (type >= sizeof(bnep_frame_hdr_sizes) / sizeof(bnep_frame_hdr_sizes[0])) {
+        BNEP_TRACE_EVENT("BNEP - rcvd frame, bad type: 0x%02x", type);
+        android_errorWriteLog(0x534e4554, "68818034");
+        osi_free(p_buf);
+        return;
+    }
     if ((rem_len <= bnep_frame_hdr_sizes[type]) || (rem_len > BNEP_MTU_SIZE))
     {
         BNEP_TRACE_EVENT ("BNEP - rcvd frame, bad len: %d  type: 0x%02x", p_buf->len, type);
@@ -524,20 +531,20 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
             org_len = rem_len;
             new_len = 0;
             do {
-
+                if (org_len < 2) break;
                 ext     = *p++;
                 length  = *p++;
                 p += length;
 
+                new_len = (length + 2);
+                if (new_len > org_len) break;
+
                 if ((!(ext & 0x7F)) && (*p > BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG))
                     bnep_send_command_not_understood (p_bcb, *p);
 
-                new_len += (length + 2);
-
-                if (new_len > org_len)
-                    break;
-
+                org_len -= new_len;
             } while (ext & 0x80);
+            android_errorWriteLog(0x534e4554, "67863755");
         }
 
         osi_free(p_buf);
@@ -586,6 +593,8 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
             while (extension_present && p && rem_len)
             {
                 ext_type = *p++;
+                rem_len--;
+                android_errorWriteLog(0x534e4554, "69271284");
                 extension_present = ext_type >> 7;
                 ext_type &= 0x7F;
 
@@ -657,6 +666,7 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
     if (bnep_cb.p_data_buf_cb)
     {
         (*bnep_cb.p_data_buf_cb)(p_bcb->handle, p_src_addr, p_dst_addr, protocol, p_buf, fw_ext_present);
+        osi_free(p_buf);
     }
     else if (bnep_cb.p_data_ind_cb)
     {

--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -22,6 +22,8 @@
  *
  ******************************************************************************/
 
+#include <cutils/log.h>
+
 #include <stdio.h>
 #include <string.h>
 #include "bt_common.h"
@@ -804,6 +806,13 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         break;
 
     case BNEP_SETUP_CONNECTION_REQUEST_MSG:
+        if (*rem_len < 1) {
+            BNEP_TRACE_ERROR(
+                "%s: Received BNEP_SETUP_CONNECTION_REQUEST_MSG with bad length",
+                __func__);
+            android_errorWriteLog(0x534e4554, "69177292");
+            goto bad_packet_length;
+        }
         len = *p++;
         if (*rem_len < ((2 * len) + 1)) {
             BNEP_TRACE_ERROR(
@@ -831,6 +840,13 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         break;
 
     case BNEP_FILTER_NET_TYPE_SET_MSG:
+        if (*rem_len < 2) {
+            BNEP_TRACE_ERROR(
+                "%s: Received BNEP_FILTER_NET_TYPE_SET_MSG with bad length",
+                __func__);
+            android_errorWriteLog(0x534e4554, "69177292");
+            goto bad_packet_length;
+        }
         BE_STREAM_TO_UINT16 (len, p);
         if (*rem_len < (len + 2))
         {
@@ -857,6 +873,13 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         break;
 
     case BNEP_FILTER_MULTI_ADDR_SET_MSG:
+        if (*rem_len < 2) {
+            BNEP_TRACE_ERROR(
+                "%s: Received BNEP_FILTER_MULTI_ADDR_SET_MSG with bad length",
+                __func__);
+            android_errorWriteLog(0x534e4554, "69177292");
+            goto bad_packet_length;
+        }
         BE_STREAM_TO_UINT16 (len, p);
         if (*rem_len < (len + 2))
         {

--- a/stack/btu/btu_init.c
+++ b/stack/btu/btu_init.c
@@ -115,6 +115,8 @@ void btu_free_core(void)
       /* Free the mandatory core stack components */
       l2c_free();
 
+      sdp_free();
+
 #if BLE_INCLUDED == TRUE
       gatt_free();
 #endif

--- a/stack/sdp/sdp_discovery.c
+++ b/stack/sdp/sdp_discovery.c
@@ -29,6 +29,7 @@
 #include "bt_target.h"
 #include "bt_common.h"
 #include "l2cdefs.h"
+#include "log/log.h"
 #include "hcidefs.h"
 #include "hcimsgs.h"
 #include "sdp_api.h"
@@ -45,9 +46,12 @@
 /*              L O C A L    F U N C T I O N     P R O T O T Y P E S            */
 /********************************************************************************/
 #if SDP_CLIENT_ENABLED == TRUE
-static void          process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply);
-static void          process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply);
-static void          process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply);
+static void          process_service_search_rsp (tCONN_CB* p_ccb, uint8_t* p_reply,
+                                                 uint8_t* p_reply_end);
+static void          process_service_attr_rsp (tCONN_CB* p_ccb, uint8_t* p_reply,
+                                               uint8_t* p_reply_end);
+static void          process_service_search_attr_rsp (tCONN_CB* p_ccb, uint8_t* p_reply,
+                                                      uint8_t* p_reply_end);
 static UINT8         *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end);
 static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda);
 static UINT8         *add_attr (UINT8 *p, tSDP_DISCOVERY_DB *p_db, tSDP_DISC_REC *p_rec,
@@ -197,7 +201,7 @@ void sdp_disc_connected (tCONN_CB *p_ccb)
     {
         p_ccb->disc_state = SDP_DISC_WAIT_SEARCH_ATTR;
 
-        process_service_search_attr_rsp (p_ccb, NULL);
+        process_service_search_attr_rsp (p_ccb, NULL, NULL);
     }
     else
     {
@@ -235,6 +239,7 @@ void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg)
 
     /* Got a reply!! Check what we got back */
     p = (UINT8 *)(p_msg + 1) + p_msg->offset;
+    uint8_t* p_end = p + p_msg->len;
 
     BE_STREAM_TO_UINT8 (rsp_pdu, p);
 
@@ -245,7 +250,7 @@ void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg)
     case SDP_PDU_SERVICE_SEARCH_RSP:
         if (p_ccb->disc_state == SDP_DISC_WAIT_HANDLES)
         {
-            process_service_search_rsp (p_ccb, p);
+            process_service_search_rsp (p_ccb, p, p_end);
             invalid_pdu = FALSE;
         }
         break;
@@ -253,7 +258,7 @@ void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg)
     case SDP_PDU_SERVICE_ATTR_RSP:
         if (p_ccb->disc_state == SDP_DISC_WAIT_ATTR)
         {
-            process_service_attr_rsp (p_ccb, p);
+            process_service_attr_rsp (p_ccb, p, p_end);
             invalid_pdu = FALSE;
         }
         break;
@@ -261,7 +266,7 @@ void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg)
     case SDP_PDU_SERVICE_SEARCH_ATTR_RSP:
         if (p_ccb->disc_state == SDP_DISC_WAIT_SEARCH_ATTR)
         {
-            process_service_search_attr_rsp (p_ccb, p);
+            process_service_search_attr_rsp (p_ccb, p, p_end);
             invalid_pdu = FALSE;
         }
         break;
@@ -284,7 +289,8 @@ void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg)
 ** Returns          void
 **
 *******************************************************************************/
-static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
+static void process_service_search_rsp (tCONN_CB* p_ccb, uint8_t* p_reply,
+                                        uint8_t* p_reply_end)
 {
     UINT16      xx;
     UINT16      total, cur_handles, orig;
@@ -321,6 +327,11 @@ static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
             sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE);
             return;
         }
+        if (p_reply + cont_len > p_reply_end) {
+            android_errorWriteLog(0x534e4554, "68161546");
+            sdp_disconnect(p_ccb, SDP_INVALID_CONT_STATE);
+            return;
+        }
         /* stay in the same state */
         sdp_snd_service_search_req(p_ccb, cont_len, p_reply);
     }
@@ -330,7 +341,7 @@ static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
         p_ccb->disc_state = SDP_DISC_WAIT_ATTR;
 
         /* Kick off the first attribute request */
-        process_service_attr_rsp (p_ccb, NULL);
+        process_service_attr_rsp (p_ccb, NULL, NULL);
     }
 }
 
@@ -405,7 +416,8 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
 ** Returns          void
 **
 *******************************************************************************/
-static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
+static void process_service_attr_rsp (tCONN_CB* p_ccb, uint8_t* p_reply,
+                                      uint8_t* p_reply_end)
 {
     UINT8           *p_start, *p_param_len;
     UINT16          param_len, list_byte_count;
@@ -512,8 +524,12 @@ static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
         /* Was this a continuation request ? */
         if (cont_request_needed)
         {
-            memcpy (p, p_reply, *p_reply + 1);
-            p += *p_reply + 1;
+            if ((p_reply + *p_reply + 1) <= p_reply_end) {
+                memcpy(p, p_reply, *p_reply + 1);
+                p += *p_reply + 1;
+            } else {
+                android_errorWriteLog(0x534e4554, "68161546");
+            }
         }
         else
             UINT8_TO_BE_STREAM (p, 0);
@@ -551,7 +567,8 @@ static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
 ** Returns          void
 **
 *******************************************************************************/
-static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
+static void process_service_search_attr_rsp (tCONN_CB* p_ccb, uint8_t* p_reply,
+                                             uint8_t* p_reply_end)
 {
     UINT8           *p, *p_start, *p_end, *p_param_len;
     UINT8           type;
@@ -651,8 +668,12 @@ static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply)
         /* No continuation for first request */
         if (p_reply)
         {
-            memcpy (p, p_reply, *p_reply + 1);
-            p += *p_reply + 1;
+            if ((p_reply + *p_reply + 1) <= p_reply_end) {
+                memcpy(p, p_reply, *p_reply + 1);
+                p += *p_reply + 1;
+            } else {
+                android_errorWriteLog(0x534e4554, "68161546");
+            }
         }
         else
             UINT8_TO_BE_STREAM (p, 0);

--- a/stack/sdp/sdp_main.c
+++ b/stack/sdp/sdp_main.c
@@ -85,6 +85,10 @@ void sdp_init (void)
     /* Clears all structures and local SDP database (if Server is enabled) */
     memset (&sdp_cb, 0, sizeof (tSDP_CB));
 
+    for (int i = 0; i < SDP_MAX_CONNECTIONS; i++) {
+        sdp_cb.ccb[i].sdp_conn_timer = alarm_new("sdp.sdp_conn_timer");
+    }
+
     /* Initialize the L2CAP configuration. We only care about MTU and flush */
     sdp_cb.l2cap_my_cfg.mtu_present       = TRUE;
     sdp_cb.l2cap_my_cfg.mtu               = SDP_MTU_SIZE;
@@ -139,6 +143,13 @@ void sdp_init (void)
     }
 }
 
+void sdp_free(void) {
+    for (int i = 0; i < SDP_MAX_CONNECTIONS; i++) {
+        alarm_free(sdp_cb.ccb[i].sdp_conn_timer);
+        sdp_cb.ccb[i].sdp_conn_timer = NULL;
+    }
+}
+
 #if (defined(SDP_DEBUG) && SDP_DEBUG == TRUE)
 /*******************************************************************************
 **

--- a/stack/sdp/sdp_server.c
+++ b/stack/sdp/sdp_server.c
@@ -23,6 +23,7 @@
  *
  ******************************************************************************/
 
+#include <cutils/log.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
@@ -387,11 +388,25 @@ void sdp_server_handle_client_req (tCONN_CB *p_ccb, BT_HDR *p_msg)
     alarm_set_on_queue(p_ccb->sdp_conn_timer, SDP_INACT_TIMEOUT_MS,
                        sdp_conn_timer_timeout, p_ccb, btu_general_alarm_queue);
 
+    if (p_req + sizeof(pdu_id) + sizeof(trans_num) > p_req_end) {
+        android_errorWriteLog(0x534e4554, "69384124");
+        trans_num = 0;
+        sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
+                                SDP_TEXT_BAD_HEADER);
+    }
+
     /* The first byte in the message is the pdu type */
     pdu_id = *p_req++;
 
     /* Extract the transaction number and parameter length */
     BE_STREAM_TO_UINT16 (trans_num, p_req);
+
+    if (p_req + sizeof(param_len) > p_req_end) {
+        android_errorWriteLog(0x534e4554, "69384124");
+        sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
+                                SDP_TEXT_BAD_HEADER);
+    }
+
     BE_STREAM_TO_UINT16 (param_len, p_req);
 
     if ((p_req + param_len) != p_req_end)
@@ -456,17 +471,14 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
     }
 
     /* Get the max replies we can send. Cap it at our max anyways. */
-    BE_STREAM_TO_UINT16 (max_replies, p_req);
-
-    if (max_replies > SDP_MAX_RECORDS)
-        max_replies = SDP_MAX_RECORDS;
-
-
-    if ((!p_req) || (p_req > p_req_end))
-    {
+    if (p_req + sizeof(max_replies) + sizeof(uint8_t) > p_req_end) {
+        android_errorWriteLog(0x534e4554, "69384124");
         sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_MAX_RECORDS_LIST);
         return;
     }
+    BE_STREAM_TO_UINT16(max_replies, p_req);
+
+    if (max_replies > SDP_MAX_RECORDS) max_replies = SDP_MAX_RECORDS;
 
 
     /* Get a list of handles that match the UUIDs given to us */
@@ -483,8 +495,8 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
     /* Check if this is a continuation request */
     if (*p_req)
     {
-        if (*p_req++ != SDP_CONTINUATION_LEN || (p_req >= p_req_end))
-        {
+        if (*p_req++ != SDP_CONTINUATION_LEN ||
+            (p_req + sizeof(cont_offset) > p_req_end)) {
             sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE,
                                      SDP_TEXT_BAD_CONT_LEN);
             return;
@@ -602,15 +614,15 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
     BOOLEAN         is_avrcp_ca_bit_reset = FALSE;
     UINT16          attr_len;
 
-    /* Extract the record handle */
-    BE_STREAM_TO_UINT32 (rec_handle, p_req);
-
-    if (p_req > p_req_end)
-    {
+    if (p_req + sizeof(rec_handle) + sizeof(max_list_len) > p_req_end) {
+        android_errorWriteLog(0x534e4554, "69384124");
         sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_SERV_REC_HDL, SDP_TEXT_BAD_HANDLE);
         return;
     }
 
+    /* Extract the record handle */
+    BE_STREAM_TO_UINT32(rec_handle, p_req);
+
     /* Get the max list length we can send. Cap it at MTU size minus overhead */
     BE_STREAM_TO_UINT16 (max_list_len, p_req);
 
@@ -619,8 +631,8 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
 
     p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq);
 
-    if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end))
-    {
+    if ((!p_req) || (!attr_seq.num_attr) ||
+        (p_req + sizeof(uint8_t) > p_req_end)) {
         sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST);
         return;
     }
@@ -635,13 +647,20 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
         return;
     }
 
+    if (max_list_len < 4) {
+        sdpu_build_n_send_error(p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);
+        android_errorWriteLog(0x534e4554, "68776054");
+        return;
+    }
+
     /* Free and reallocate buffer */
     osi_free(p_ccb->rsp_list);
     p_ccb->rsp_list = (UINT8 *)osi_malloc(max_list_len);
 
     /* Check if this is a continuation request */
     if (*p_req) {
-        if (*p_req++ != SDP_CONTINUATION_LEN) {
+        if (*p_req++ != SDP_CONTINUATION_LEN ||
+            (p_req + sizeof(cont_offset) > p_req_end)) {
             sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
                                     SDP_TEXT_BAD_CONT_LEN);
             return;
@@ -938,8 +957,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
     /* Extract the UUID sequence to search for */
     p_req = sdpu_extract_uid_seq (p_req, param_len, &uid_seq);
 
-    if ((!p_req) || (!uid_seq.num_uids))
-    {
+    if ((!p_req) || (!uid_seq.num_uids) ||
+        (p_req + sizeof(uint16_t) > p_req_end)) {
         sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_UUID_LIST);
         return;
     }
@@ -952,21 +971,28 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
 
     p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq);
 
-    if ((!p_req) || (!attr_seq.num_attr))
-    {
+    if ((!p_req) || (!attr_seq.num_attr) ||
+        (p_req + sizeof(uint8_t) > p_req_end)) {
         sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST);
         return;
     }
 
     memcpy(&attr_seq_sav, &attr_seq, sizeof(tSDP_ATTR_SEQ)) ;
 
+    if (max_list_len < 4) {
+        sdpu_build_n_send_error(p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);
+        android_errorWriteLog(0x534e4554, "68817966");
+        return;
+    }
+
     /* Free and reallocate buffer */
     osi_free(p_ccb->rsp_list);
     p_ccb->rsp_list = (UINT8 *)osi_malloc(max_list_len);
 
     /* Check if this is a continuation request */
     if (*p_req) {
-        if (*p_req++ != SDP_CONTINUATION_LEN) {
+        if (*p_req++ != SDP_CONTINUATION_LEN ||
+            (p_req + sizeof(uint16_t) > p_req_end)) {
             sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
                                     SDP_TEXT_BAD_CONT_LEN);
             return;

--- a/stack/sdp/sdp_utils.c
+++ b/stack/sdp/sdp_utils.c
@@ -120,8 +120,9 @@ tCONN_CB *sdpu_allocate_ccb (void)
     {
         if (p_ccb->con_state == SDP_STATE_IDLE)
         {
+            alarm_t* alarm = p_ccb->sdp_conn_timer;
             memset(p_ccb, 0, sizeof(tCONN_CB));
-            p_ccb->sdp_conn_timer = alarm_new("sdp.sdp_conn_timer");
+            p_ccb->sdp_conn_timer = alarm;
             return (p_ccb);
         }
     }
@@ -143,8 +144,7 @@ tCONN_CB *sdpu_allocate_ccb (void)
 void sdpu_release_ccb (tCONN_CB *p_ccb)
 {
     /* Ensure timer is stopped */
-    alarm_free(p_ccb->sdp_conn_timer);
-    p_ccb->sdp_conn_timer = NULL;
+    alarm_cancel(p_ccb->sdp_conn_timer);
 
     /* Drop any response pointer we may be holding */
     p_ccb->con_state = SDP_STATE_IDLE;
@@ -406,6 +406,8 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
     p_seq->num_uids = 0;
 
     /* A UID sequence is composed of a bunch of UIDs. */
+    if (sizeof(descr) > param_len) return (NULL);
+    param_len -= sizeof(descr);
 
     BE_STREAM_TO_UINT8 (descr, p);
     type = descr >> 3;
@@ -426,19 +428,25 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
         seq_len = 16;
         break;
     case SIZE_IN_NEXT_BYTE:
+        if (sizeof(uint8_t) > param_len) return (NULL);
+        param_len -= sizeof(uint8_t);
         BE_STREAM_TO_UINT8 (seq_len, p);
         break;
     case SIZE_IN_NEXT_WORD:
+        if (sizeof(uint16_t) > param_len) return (NULL);
+        param_len -= sizeof(uint16_t);
         BE_STREAM_TO_UINT16 (seq_len, p);
         break;
     case SIZE_IN_NEXT_LONG:
+        if (sizeof(uint32_t) > param_len) return (NULL);
+        param_len -= sizeof(uint32_t);
         BE_STREAM_TO_UINT32 (seq_len, p);
         break;
     default:
         return (NULL);
     }
 
-    if (seq_len >= param_len)
+    if (seq_len > param_len)
         return (NULL);
 
     p_seq_end = p + seq_len;
@@ -465,12 +473,15 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
             uuid_len = 16;
             break;
         case SIZE_IN_NEXT_BYTE:
+            if (p + sizeof(uint8_t) > p_seq_end) return NULL;
             BE_STREAM_TO_UINT8 (uuid_len, p);
             break;
         case SIZE_IN_NEXT_WORD:
+            if (p + sizeof(uint16_t) > p_seq_end) return NULL;
             BE_STREAM_TO_UINT16 (uuid_len, p);
             break;
         case SIZE_IN_NEXT_LONG:
+            if (p + sizeof(uint32_t) > p_seq_end) return NULL;
             BE_STREAM_TO_UINT32 (uuid_len, p);
             break;
         default:
@@ -478,8 +489,8 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
         }
 
         /* If UUID length is valid, copy it across */
-        if ((uuid_len == 2) || (uuid_len == 4) || (uuid_len == 16))
-        {
+        if (((uuid_len == 2) || (uuid_len == 4) || (uuid_len == 16)) &&
+            (p + uuid_len <= p_seq_end)) {
             p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len;
             BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len);
             p_seq->num_uids++;
@@ -520,33 +531,41 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
     p_seq->num_attr = 0;
 
     /* Get attribute sequence info */
+    if (param_len < sizeof(descr)) return NULL;
+    param_len -= sizeof(descr);
     BE_STREAM_TO_UINT8 (descr, p);
     type = descr >> 3;
     size = descr & 7;
 
     if (type != DATA_ELE_SEQ_DESC_TYPE)
-        return (p);
+        return NULL;
 
     switch (size)
     {
     case SIZE_IN_NEXT_BYTE:
+        if (param_len < sizeof(uint8_t)) return NULL;
+        param_len -= sizeof(uint8_t);
         BE_STREAM_TO_UINT8 (list_len, p);
         break;
 
     case SIZE_IN_NEXT_WORD:
+        if (param_len < sizeof(uint16_t)) return NULL;
+        param_len -= sizeof(uint16_t);
         BE_STREAM_TO_UINT16 (list_len, p);
         break;
 
     case SIZE_IN_NEXT_LONG:
+        if (param_len < sizeof(uint32_t)) return NULL;
+        param_len -= sizeof(uint32_t);
         BE_STREAM_TO_UINT32 (list_len, p);
         break;
 
     default:
-        return (p);
+        return NULL;
     }
 
     if (list_len > param_len)
-        return (p);
+        return NULL;
 
     p_end_list = p + list_len;
 
@@ -558,7 +577,7 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
         size = descr & 7;
 
         if (type != UINT_DESC_TYPE)
-            return (p);
+            return NULL;
 
         switch (size)
         {
@@ -569,20 +588,24 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
             attr_len = 4;
             break;
         case SIZE_IN_NEXT_BYTE:
+            if (p + sizeof(uint8_t) > p_end_list) return NULL;
             BE_STREAM_TO_UINT8 (attr_len, p);
             break;
         case SIZE_IN_NEXT_WORD:
+            if (p + sizeof(uint16_t) > p_end_list) return NULL;
             BE_STREAM_TO_UINT16 (attr_len, p);
             break;
         case SIZE_IN_NEXT_LONG:
+            if (p + sizeof(uint32_t) > p_end_list) return NULL;
             BE_STREAM_TO_UINT32 (attr_len, p);
             break;
         default:
-            return (NULL);
+            return NULL;
             break;
         }
 
         /* Attribute length must be 2-bytes or 4-bytes for a paired entry. */
+        if (p + attr_len > p_end_list) return NULL;
         if (attr_len == 2)
         {
             BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p);

--- a/stack/sdp/sdpint.h
+++ b/stack/sdp/sdpint.h
@@ -247,6 +247,7 @@ extern tSDP_CB *sdp_cb_ptr;
 
 /* Functions provided by sdp_main.c */
 extern void     sdp_init (void);
+extern void     sdp_free(void);
 extern void     sdp_disconnect (tCONN_CB*p_ccb, UINT16 reason);
 
 #if (defined(SDP_DEBUG) && SDP_DEBUG == TRUE)

--- a/stack/smp/smp_utils.c
+++ b/stack/smp/smp_utils.c
@@ -297,8 +297,7 @@ BOOLEAN  smp_send_msg_to_L2CAP(BD_ADDR rem_bda, BT_HDR *p_toL2CAP)
     if ((l2cap_ret = L2CA_SendFixedChnlData (fixed_cid, rem_bda, p_toL2CAP)) == L2CAP_DW_FAILED)
     {
         smp_cb.total_tx_unacked -= 1;
-        SMP_TRACE_ERROR("SMP   failed to pass msg:0x%0x to L2CAP",
-                         *((UINT8 *)(p_toL2CAP + 1) + p_toL2CAP->offset));
+        SMP_TRACE_ERROR("SMP failed to pass msg to L2CAP");
         return FALSE;
     }
     else