提交: c9b410982c53a744596636bf72affb40185a35cb - system-bt (git)

system/bt

Commit MetaInfo

• 修订版: c9b410982c53a744596636bf72affb40185a35cb (tree)
• 时间: 2021-03-02 23:23:40
• 作者: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Log Message

Android 8.1.0 Release 81 (6780335)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCX3uqgQAKCRDorT+BmrEO
eAgWAJsEgQwQfqXSiJQ97yfqLg28AlAWngCeMszhF7t9+M6+t/A5JdPlEhow2qY=
=H8Ei
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r81' into oreo-x86

Android 8.1.0 Release 81 (6780335)

更改概述

• modified: embdrv/sbc/decoder/srce/decoder-sbc.c
• modified: stack/btm/btm_sec.cc
• modified: stack/gatt/gatt_cl.cc

差异

--- a/embdrv/sbc/decoder/srce/decoder-sbc.c
+++ b/embdrv/sbc/decoder/srce/decoder-sbc.c
@@ -311,7 +311,6 @@ OI_STATUS OI_CODEC_SBC_DecodeFrame(OI_CODEC_SBC_DECODER_CONTEXT* context,
     return OI_CODEC_SBC_CHECKSUM_MISMATCH;
   }
 
-#ifdef OI_DEBUG
   /*
    * Make sure the bitpool values are sane.
    */
@@ -328,7 +327,6 @@ OI_STATUS OI_CODEC_SBC_DecodeFrame(OI_CODEC_SBC_DECODER_CONTEXT* context,
            OI_SBC_MaxBitpool(&context->common.frameInfo)));
     return OI_STATUS_INVALID_PARAMETERS;
   }
-#endif
 
   /*
    * Now decode the SBC data. Partial decode is not yet implemented for an SBC

--- a/stack/btm/btm_sec.cc
+++ b/stack/btm/btm_sec.cc
@@ -51,6 +51,8 @@
 bool(APPL_AUTH_WRITE_EXCEPTION)(const RawAddress& bd_addr);
 #endif
 
+extern void bta_dm_process_remove_device(const RawAddress& bd_addr);
+
 /*******************************************************************************
  *             L O C A L    F U N C T I O N     P R O T O T Y P E S            *
  ******************************************************************************/
@@ -3280,6 +3282,13 @@ void btm_io_capabilities_req(const RawAddress& p) {
   BTM_TRACE_EVENT("%s: State: %s", __func__,
                   btm_pair_state_descr(btm_cb.pairing_state));
 
+  if (btm_sec_is_a_bonded_dev(p)) {
+    BTM_TRACE_WARNING(
+        "%s: Incoming bond request, but %s is already bonded (removing)",
+        __func__, p.ToString().c_str());
+    bta_dm_process_remove_device(p);
+  }
+
   p_dev_rec = btm_find_or_alloc_dev(evt_data.bd_addr);
 
   BTM_TRACE_DEBUG("%s:Security mode: %d, Num Read Remote Feat pages: %d",

--- a/stack/gatt/gatt_cl.cc
+++ b/stack/gatt/gatt_cl.cc
@@ -762,6 +762,12 @@ void gatt_process_read_by_type_rsp(tGATT_TCB& tcb, tGATT_CLCB* p_clcb,
     /* discover included service */
     else if (p_clcb->operation == GATTC_OPTYPE_DISCOVERY &&
              p_clcb->op_subtype == GATT_DISC_INC_SRVC) {
+      if (value_len < 4) {
+        android_errorWriteLog(0x534e4554, "158833854");
+        LOG(ERROR) << __func__ << " Illegal Response length, must be at least 4.";
+        gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
+        return;
+      }
       STREAM_TO_UINT16(record_value.incl_service.s_handle, p);
       STREAM_TO_UINT16(record_value.incl_service.e_handle, p);
 
@@ -813,6 +819,12 @@ void gatt_process_read_by_type_rsp(tGATT_TCB& tcb, tGATT_CLCB* p_clcb,
       return;
     } else /* discover characterisitic */
     {
+      if (value_len < 3) {
+        android_errorWriteLog(0x534e4554, "158778659");
+        LOG(ERROR) << __func__ << " Illegal Response length, must be at least 3.";
+        gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
+        return;
+      }
       STREAM_TO_UINT8(record_value.dclr_value.char_prop, p);
       STREAM_TO_UINT16(record_value.dclr_value.val_handle, p);
       if (!GATT_HANDLE_IS_VALID(record_value.dclr_value.val_handle)) {