bta_dm: Stop copying garbage

After we reach 7 ACL connections we have 7 peer device records.
Once we reach this then we lose a connection and shrink the list we
copy garbage into the last peer device record.  This can cause the flag
remove_dev_pending to be set to something > 0 thus true which causes the
stack to remove the device and its bonding information on the next
acl change event.

ACL Connections can happen from any connection (pairing, SDP, etc...)

Bug: 36598959
Test: Manual
Change-Id: Ifbaa4098edba442274ffde183960ef53169988e7

diff --git a/bta/dm/bta_dm_act.cc b/bta/dm/bta_dm_act.cc
index 1d6bb06..caf207b 100644 (file)
--- a/bta/dm/bta_dm_act.cc
+++ b/bta/dm/bta_dm_act.cc
@@ -3062,11 +3062,19 @@ void bta_dm_acl_change(tBTA_DM_MSG* p_data) {
       conn.link_down.is_removed =
           bta_dm_cb.device_list.peer_device[i].remove_dev_pending;
 
-      for (; i < bta_dm_cb.device_list.count; i++) {
+      // Iterate to the one before the last when shrinking the list,
+      // otherwise we memcpy garbage data into the record.
+      // Then clear out the last item in the list since we are shrinking.
+      for (; i < bta_dm_cb.device_list.count - 1; i++) {
         memcpy(&bta_dm_cb.device_list.peer_device[i],
                &bta_dm_cb.device_list.peer_device[i + 1],
                sizeof(bta_dm_cb.device_list.peer_device[i]));
       }
+      if (bta_dm_cb.device_list.count > 0) {
+        int clear_index = bta_dm_cb.device_list.count - 1;
+        memset(&bta_dm_cb.device_list.peer_device[clear_index], 0,
+               sizeof(bta_dm_cb.device_list.peer_device[clear_index]));
+      }
       break;
     }
     if (bta_dm_cb.device_list.count) bta_dm_cb.device_list.count--;