DO NOT MERGE: Check number of attributes before writing to a buffer

[android-x86/system-bt.git] / btif / src / btif_rc.c

diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index 9bc57fd..28a2499 100644 (file)
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -47,6 +47,7 @@
 #include "osi/include/list.h"
 #include "osi/include/properties.h"
 #include "btu.h"
+#include "log/log.h"
 #define RC_INVALID_TRACK_ID (0xFFFFFFFFFFFFFFFFULL)
 
 /*****************************************************************************
@@ -279,6 +280,7 @@ static void btif_rc_upstreams_rsp_evt(UINT16 event, tAVRC_RESPONSE *pavrc_resp,
 #endif
 static void rc_start_play_status_timer(void);
 static bool absolute_volume_disabled(void);
+static char const* key_id_to_str(uint16_t id);
 
 /*****************************************************************************
 **  Static variables
@@ -316,7 +318,9 @@ int send_event (int fd, uint16_t type, uint16_t code, int32_t value)
     event.code  = code;
     event.value = value;
 
-    return write(fd, &event, sizeof(event));
+    ssize_t ret;
+    OSI_NO_INTR(ret = write(fd, &event, sizeof(event)));
+    return (int)ret;
 }
 
 void send_key (int fd, uint16_t key, int pressed)
@@ -329,7 +333,7 @@ void send_key (int fd, uint16_t key, int pressed)
         return;
     }
 
-    BTIF_TRACE_DEBUG("AVRCP: Send key %d (%d) fd=%d", key, pressed, fd);
+    LOG_INFO(LOG_TAG, "AVRCP: Send key %s (%d) fd=%d", key_id_to_str(key), pressed, fd);
     send_event(fd, EV_KEY, key, pressed);
     send_event(fd, EV_SYN, SYN_REPORT, 0);
 }
@@ -373,7 +377,9 @@ int uinput_create(char *name)
     dev.id.product = 0x0000;
     dev.id.version = 0x0000;
 
-    if (write(fd, &dev, sizeof(dev)) < 0) {
+    ssize_t ret;
+    OSI_NO_INTR(ret = write(fd, &dev, sizeof(dev)));
+    if (ret < 0) {
         BTIF_TRACE_ERROR("%s Unable to write device information", __FUNCTION__);
         close(fd);
         return -1;
@@ -453,7 +459,9 @@ void handle_rc_ctrl_features(BD_ADDR bd_addr)
              * update.
              */
             btif_rc_cb.rc_features_processed = TRUE;
-            getcapabilities_cmd (AVRC_CAP_COMPANY_ID);
+
+            if (btif_av_is_sink_enabled())
+                getcapabilities_cmd (AVRC_CAP_COMPANY_ID);
         }
         BTIF_TRACE_DEBUG("%s Update rc features to CTRL %d", __FUNCTION__, rc_features);
         HAL_CBACK(bt_rc_ctrl_callbacks, getrcfeatures_cb, &rc_addr, rc_features);
@@ -2086,8 +2094,8 @@ static void btif_rc_status_cmd_timeout_handler(UNUSED_ATTR uint16_t event,
         break;
 
     case AVRC_PDU_GET_PLAY_STATUS:
-        avrc_response.get_caps.status = BTIF_RC_STS_TIMEOUT;
-        handle_get_capability_response(&meta_msg, &avrc_response.get_caps);
+        avrc_response.get_play_status.status = BTIF_RC_STS_TIMEOUT;
+        handle_get_playstatus_response(&meta_msg, &avrc_response.get_play_status);
         break;
     }
     release_transaction(p_context->rc_status_cmd.label);
@@ -2757,6 +2765,12 @@ static void handle_app_cur_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_
     bdcpy(rc_addr.address, btif_rc_cb.rc_addr);
 
     app_settings.num_attr = p_rsp->num_val;
+
+    if (app_settings.num_attr > BTRC_MAX_APP_SETTINGS) {
+        android_errorWriteLog(0x534e4554, "73824150");
+        app_settings.num_attr = BTRC_MAX_APP_SETTINGS;
+    }
+
     for (xx = 0; xx < app_settings.num_attr; xx++)
     {
         app_settings.attr_ids[xx] = p_rsp->p_vals[xx].attr_id;
@@ -4232,10 +4246,7 @@ static void sleep_ms(period_ms_t timeout_ms) {
     delay.tv_sec = timeout_ms / 1000;
     delay.tv_nsec = 1000 * 1000 * (timeout_ms % 1000);
 
-    int err;
-    do {
-        err = nanosleep(&delay, &delay);
-    } while (err == -1 && errno == EINTR);
+    OSI_NO_INTR(nanosleep(&delay, &delay));
 }
 
 static bool absolute_volume_disabled() {
@@ -4247,3 +4258,11 @@ static bool absolute_volume_disabled() {
     }
     return false;
 }
+
+static char const* key_id_to_str(uint16_t id) {
+    for (int i = 0; key_map[i].name != NULL; i++) {
+        if (id == key_map[i].mapped_id)
+            return key_map[i].name;
+    }
+    return "UNKNOWN KEY";
+}