OSDN Git Service
Scott Bauer [Wed, 11 Oct 2017 22:26:14 +0000 (22:26 +0000)]
Read the correct amount of attributes
am:
4d1470eb54
Change-Id: I153a91a1aba1a78837c397d4ee01bea2d1696e4e
Scott Bauer [Fri, 7 Apr 2017 00:35:40 +0000 (18:35 -0600)]
Read the correct amount of attributes
bta_gattc_cache_load currently attempts to read 0xFF attributes into an
allocation sized to num_attr attributes, which can be smaller than 0xFF.
There aren't more than num_attr bytes in correct data, but this breaks
with dynamic buffer overflow checking in CopperheadOS for the read
system call since fread ends up calling read, which obtains the size of
the allocation from the malloc implementation and then aborts due to the
(potential) overflow.
This would also fail with the default enabled _FORTIFY_SOURCE=2 feature
in the Android Open Source Project if osi_malloc was marked with the
alloc_size attribute. The way it wraps malloc loses that information so
fortify checks aren't done for calls like this.
Bug:
37160362
Change-Id: I68bd170d5378c9d9d21cbda376083bc0b857e15c
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
[migrated to C++ file, added 0xFFFF limit and wrote commit message]
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Andre Eisenbach [Thu, 17 Aug 2017 00:42:45 +0000 (00:42 +0000)]
SDP: Bounds check 'id' parameter for free_sdp_slot() am:
294cc61f4f am:
5dc24c7b41 am:
8498351370 am:
615de1d1fe -s ours
am:
1ee8850324 -s ours
Change-Id: I5f54fca3ea0d17cad9a5e5439265c9b40340036c
Andre Eisenbach [Thu, 17 Aug 2017 00:39:39 +0000 (00:39 +0000)]
SDP: Bounds check 'id' parameter for free_sdp_slot() am:
294cc61f4f am:
5dc24c7b41 am:
8498351370
am:
615de1d1fe -s ours
Change-Id: I2e6425620ccf65636ba0b0ba6c783c8bf8764ec0
Andre Eisenbach [Thu, 17 Aug 2017 00:37:42 +0000 (00:37 +0000)]
SDP: Bounds check 'id' parameter for free_sdp_slot() am:
294cc61f4f am:
5dc24c7b41
am:
8498351370
Change-Id: I171cafa603f3bf9d6a91895aba461fa96711c18c
Andre Eisenbach [Thu, 17 Aug 2017 00:32:37 +0000 (00:32 +0000)]
SDP: Bounds check 'id' parameter for free_sdp_slot() am:
294cc61f4f
am:
5dc24c7b41
Change-Id: I27dffd6583706912f79cfd730eca390e930e9294
Andre Eisenbach [Thu, 17 Aug 2017 00:30:38 +0000 (00:30 +0000)]
SDP: Bounds check 'id' parameter for free_sdp_slot()
am:
294cc61f4f
Change-Id: Ief8d911221408ff79a5addc7a7d58c7ca1a38808
Andre Eisenbach [Wed, 16 Aug 2017 22:52:42 +0000 (22:52 +0000)]
SDP: Bounds check 'id' parameter for free_sdp_slot()
am:
82e4754aaa
Change-Id: Ica0050f493b45e216daa4c31e6eea38a4921d356
Andre Eisenbach [Tue, 8 Aug 2017 23:51:12 +0000 (16:51 -0700)]
SDP: Bounds check 'id' parameter for free_sdp_slot()
Merged-In: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7
Test: manual
Fixes:
37502513
Change-Id: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7
(cherry picked from commit
b413f1b1365af4273647727e497848f95312d0ec)
Andre Eisenbach [Tue, 8 Aug 2017 22:41:21 +0000 (15:41 -0700)]
SDP: Bounds check 'id' parameter for free_sdp_slot()
Merged-In: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7
Test: manual
Fixes:
37502513
Change-Id: I34e8296ec7ec6b4ffbe1fa0452754f2a421e6ec7
(cherry picked from commit
b413f1b1365af4273647727e497848f95312d0ec)
Pavlin Radoslavov [Tue, 18 Jul 2017 19:12:54 +0000 (19:12 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into mnc-dev am:
fdcad53f8e am:
fd94c15a5a am:
0cea290eee am:
97922c7401
am:
c0008b6c2f
Change-Id: Id14d11e553b6ba2f3fa688302415c79a537940a2
Pavlin Radoslavov [Tue, 18 Jul 2017 19:12:36 +0000 (19:12 +0000)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks am:
8f18afd26c am:
ffa87779a1 am:
7eda996189 am:
ba12732aad -s ours
am:
107bb0f68d -s ours
Change-Id: Ib74d462308ed0e99f75aaca7e9344de3b07ba5a8
Pavlin Radoslavov [Tue, 18 Jul 2017 19:05:51 +0000 (19:05 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into mnc-dev am:
fdcad53f8e am:
fd94c15a5a am:
0cea290eee
am:
97922c7401
Change-Id: Id1569df9156b8de893dcb5c28997ec4a924eb82e
Pavlin Radoslavov [Tue, 18 Jul 2017 19:05:38 +0000 (19:05 +0000)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks am:
8f18afd26c am:
ffa87779a1 am:
7eda996189
am:
ba12732aad -s ours
Change-Id: Id1a43cefdc006f9f6d24b35b21502c8453bdd673
Pavlin Radoslavov [Tue, 18 Jul 2017 19:01:19 +0000 (19:01 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into mnc-dev am:
fdcad53f8e am:
fd94c15a5a
am:
0cea290eee
Change-Id: I24ad37b139ec7af93fde160b16da095d77bd4729
Pavlin Radoslavov [Tue, 18 Jul 2017 19:01:05 +0000 (19:01 +0000)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks am:
8f18afd26c am:
ffa87779a1
am:
7eda996189
Change-Id: I3587c48c072b808e8a84a63d1e6f63ea39f158b5
Pavlin Radoslavov [Tue, 18 Jul 2017 18:55:45 +0000 (18:55 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into mnc-dev am:
fdcad53f8e
am:
fd94c15a5a
Change-Id: I635b78d48c94608adb9a1ef784bf5884f64610a3
Pavlin Radoslavov [Tue, 18 Jul 2017 18:55:33 +0000 (18:55 +0000)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks am:
8f18afd26c
am:
ffa87779a1
Change-Id: I4e93ec83fac0bfa764f7b78bf33d0ba088e5bc3a
Pavlin Radoslavov [Tue, 18 Jul 2017 18:51:27 +0000 (18:51 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into mnc-dev
am:
fdcad53f8e
Change-Id: I3ae12cba736d90e70bb52888063304337550081c
Pavlin Radoslavov [Tue, 18 Jul 2017 18:51:03 +0000 (18:51 +0000)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks
am:
8f18afd26c
Change-Id: I23886b18719d28ef3ae397ec6444b9e2692885e8
Pavlin Radoslavov [Tue, 18 Jul 2017 18:50:50 +0000 (18:50 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into nyc-dev
am:
c3619e1436
Change-Id: Iab6a952226fae34db9f34192312839c03cb800d7
Pavlin Radoslavov [Tue, 18 Jul 2017 18:50:36 +0000 (18:50 +0000)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks
am:
f8fc7f7d11
Change-Id: Ib41c89b0070c24eb22576bc6536a5b63d19406a7
TreeHugger Robot [Tue, 18 Jul 2017 18:46:45 +0000 (18:46 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into mnc-dev
TreeHugger Robot [Tue, 18 Jul 2017 18:45:57 +0000 (18:45 +0000)]
Merge "Add missing extension length check while parsing BNEP control packets" into nyc-dev
Pavlin Radoslavov [Tue, 18 Jul 2017 01:12:10 +0000 (18:12 -0700)]
Add missing extension length check while parsing BNEP control packets
Bug:
63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit
9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit
dc7700a43189d2a8607b69ae19a6d646f11ddf51)
(cherry picked from commit
c7874f25a0557ca4413d8db80bab8da842fc389a)
(cherry picked from commit
187bd8aec0aae63c6328981041e5ec7764ece6a9)
(cherry picked from commit
01f46e0aff705dab350cda7f648fb94976ea3988)
Pavlin Radoslavov [Tue, 18 Jul 2017 01:12:10 +0000 (18:12 -0700)]
Add missing extension length check while parsing BNEP control packets
Bug:
63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit
9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit
dc7700a43189d2a8607b69ae19a6d646f11ddf51)
(cherry picked from commit
c7874f25a0557ca4413d8db80bab8da842fc389a)
(cherry picked from commit
187bd8aec0aae63c6328981041e5ec7764ece6a9)
Pavlin Radoslavov [Tue, 18 Jul 2017 00:21:16 +0000 (17:21 -0700)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks
Bug:
63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit
4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
(cherry picked from commit
a654681c5558904a8abfa1bbab8eafb651c13231)
(cherry picked from commit
64a12d3b6e71d9161837f28ce18c34d924c2bafc)
(cherry picked from commit
8f18afd26c02ae3d46bf14d6e36017965dee0394)
Pavlin Radoslavov [Tue, 18 Jul 2017 00:21:16 +0000 (17:21 -0700)]
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks
Bug:
63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit
4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
(cherry picked from commit
a654681c5558904a8abfa1bbab8eafb651c13231)
(cherry picked from commit
64a12d3b6e71d9161837f28ce18c34d924c2bafc)
Pavlin Radoslavov [Thu, 13 Jul 2017 19:27:42 +0000 (19:27 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into mnc-dev am:
c41ba8a569 am:
494625245f am:
19b22ffe8a am:
df16497d1c -s ours
am:
9aad8b3ffe -s ours
Change-Id: I04d5e837ffa4142d9a4b4db92a9cf63f5fc48e29
Pavlin Radoslavov [Thu, 13 Jul 2017 19:25:41 +0000 (19:25 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into mnc-dev am:
c41ba8a569 am:
494625245f am:
19b22ffe8a
am:
df16497d1c -s ours
Change-Id: I43ac50a1683bef1b0f92f03296ba68f6dc0880da
Pavlin Radoslavov [Thu, 13 Jul 2017 19:22:46 +0000 (19:22 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into mnc-dev am:
c41ba8a569 am:
494625245f
am:
19b22ffe8a
Change-Id: Ia027b6cc651ffc920d5fafb7f8dad8f442220706
Pavlin Radoslavov [Thu, 13 Jul 2017 19:20:42 +0000 (19:20 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into mnc-dev am:
c41ba8a569
am:
494625245f
Change-Id: I3de1f423efacac96493de69033538157be2ca8f9
Pavlin Radoslavov [Thu, 13 Jul 2017 19:18:47 +0000 (19:18 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into mnc-dev
am:
c41ba8a569
Change-Id: I85c402bbc30c9954c71be3fe907651b76387653a
Pavlin Radoslavov [Thu, 13 Jul 2017 19:11:44 +0000 (19:11 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into nyc-dev
am:
db82859274
Change-Id: I2341681c821d2902ba79d652edb55167f26b7153
TreeHugger Robot [Thu, 13 Jul 2017 19:09:02 +0000 (19:09 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into mnc-dev
TreeHugger Robot [Thu, 13 Jul 2017 19:01:54 +0000 (19:01 +0000)]
Merge "Add a missing check for PAN buffer size before copying data" into nyc-dev
Pavlin Radoslavov [Thu, 13 Jul 2017 18:24:37 +0000 (18:24 +0000)]
Merge "Add missing packet length checks while parsing BNEP control packets" into mnc-dev am:
64d3ed3c9d am:
6fca688b42 am:
7a30f0c78a am:
9dc57eff7a
am:
9a7909fefe
Change-Id: I9734ec3d308ab8fb98a5923241fbab91ad81af28
Pavlin Radoslavov [Thu, 13 Jul 2017 18:24:21 +0000 (18:24 +0000)]
Merge "Add missing continuation offset check for SDP continuation requests" into mnc-dev am:
b5cb6103b9 am:
70ef60cac0 am:
da8e592089 am:
634fc84bbd
am:
f4cca28ce7
Change-Id: I634762cc7468a03ca94702153dc638ac5506d20a
Pavlin Radoslavov [Thu, 13 Jul 2017 18:24:04 +0000 (18:24 +0000)]
Merge "Allocate buffers of the right size when BT_HDR is included" into mnc-dev am:
d2a3649d6e am:
27db9becc7 am:
84714e10d8 am:
8ec036d751 -s ours
am:
a6996df21f -s ours
Change-Id: Icef81edd5fec2d5edee0af3c02f4b85ea75a9d0f
Pavlin Radoslavov [Thu, 13 Jul 2017 18:23:39 +0000 (18:23 +0000)]
Disable PAN Reverse Tethering when connection originated by the Remote am:
f7a7f7a948 am:
b4cf6c5aa7 am:
5d9bbfe453 am:
c80b2fc096 -s ours
am:
f79aebe2b9 -s ours
Change-Id: I98be6f0d6399502bbf523e3531865a608111c076
Pavlin Radoslavov [Thu, 13 Jul 2017 18:21:35 +0000 (18:21 +0000)]
Merge "Add missing packet length checks while parsing BNEP control packets" into mnc-dev am:
64d3ed3c9d am:
6fca688b42 am:
7a30f0c78a
am:
9dc57eff7a
Change-Id: Iefe422511cd90f86d95b7d5c576161aae80055e9
Pavlin Radoslavov [Thu, 13 Jul 2017 18:21:15 +0000 (18:21 +0000)]
Merge "Add missing continuation offset check for SDP continuation requests" into mnc-dev am:
b5cb6103b9 am:
70ef60cac0 am:
da8e592089
am:
634fc84bbd
Change-Id: I35386fe81935831e344265a879e8ee2bc05e4dc7
Pavlin Radoslavov [Thu, 13 Jul 2017 18:20:57 +0000 (18:20 +0000)]
Merge "Allocate buffers of the right size when BT_HDR is included" into mnc-dev am:
d2a3649d6e am:
27db9becc7 am:
84714e10d8
am:
8ec036d751 -s ours
Change-Id: I3735cfa1430daf543d5cbfdb1609176443feba86
Pavlin Radoslavov [Thu, 13 Jul 2017 18:20:40 +0000 (18:20 +0000)]
Disable PAN Reverse Tethering when connection originated by the Remote am:
f7a7f7a948 am:
b4cf6c5aa7 am:
5d9bbfe453
am:
c80b2fc096 -s ours
Change-Id: I143dcc7f5db0b852b596eeb62ac78f1beda40b3c
Pavlin Radoslavov [Thu, 13 Jul 2017 18:19:03 +0000 (18:19 +0000)]
Merge "Add missing packet length checks while parsing BNEP control packets" into mnc-dev am:
64d3ed3c9d am:
6fca688b42
am:
7a30f0c78a
Change-Id: I77d2ac1b4e2e271d42cf555f66951217db7c7f05
Pavlin Radoslavov [Thu, 13 Jul 2017 18:18:49 +0000 (18:18 +0000)]
Merge "Add missing continuation offset check for SDP continuation requests" into mnc-dev am:
b5cb6103b9 am:
70ef60cac0
am:
da8e592089
Change-Id: Ibc97e933ab9dbcb262753946ca0bad8ed3fe716d
Pavlin Radoslavov [Thu, 13 Jul 2017 18:18:33 +0000 (18:18 +0000)]
Merge "Allocate buffers of the right size when BT_HDR is included" into mnc-dev am:
d2a3649d6e am:
27db9becc7
am:
84714e10d8
Change-Id: I1a88047cdf70026aaa57f747e4ce614b1d496df0
Pavlin Radoslavov [Thu, 13 Jul 2017 18:18:09 +0000 (18:18 +0000)]
Disable PAN Reverse Tethering when connection originated by the Remote am:
f7a7f7a948 am:
b4cf6c5aa7
am:
5d9bbfe453
Change-Id: I0d39c39b4b573b7df297ed1d93191aff18712fec
Pavlin Radoslavov [Thu, 13 Jul 2017 18:16:48 +0000 (18:16 +0000)]
Merge "Add missing packet length checks while parsing BNEP control packets" into mnc-dev am:
64d3ed3c9d
am:
6fca688b42
Change-Id: I2f4b155188edb226c208350addc1d342ef90a55a
Pavlin Radoslavov [Thu, 13 Jul 2017 18:16:35 +0000 (18:16 +0000)]
Merge "Add missing continuation offset check for SDP continuation requests" into mnc-dev am:
b5cb6103b9
am:
70ef60cac0
Change-Id: I17a95052722739e6329e9759fafe1c0a7acfa067
Pavlin Radoslavov [Thu, 13 Jul 2017 18:16:22 +0000 (18:16 +0000)]
Merge "Allocate buffers of the right size when BT_HDR is included" into mnc-dev am:
d2a3649d6e
am:
27db9becc7
Change-Id: I5a5ea407d003fc297ee89837ff22fcc0d946c735
Pavlin Radoslavov [Thu, 13 Jul 2017 18:16:08 +0000 (18:16 +0000)]
Disable PAN Reverse Tethering when connection originated by the Remote am:
f7a7f7a948
am:
b4cf6c5aa7
Change-Id: I915ceaf816dc806ba91da7791aa1b43460615935
Pavlin Radoslavov [Thu, 13 Jul 2017 18:14:31 +0000 (18:14 +0000)]
Merge "Add missing packet length checks while parsing BNEP control packets" into mnc-dev
am:
64d3ed3c9d
Change-Id: I2ec8b4f3b50082036ce1f335d36fd728cb9c3665
Pavlin Radoslavov [Thu, 13 Jul 2017 18:14:11 +0000 (18:14 +0000)]
Merge "Add missing continuation offset check for SDP continuation requests" into mnc-dev
am:
b5cb6103b9
Change-Id: I12c131aa3543e524f669f038153de2dbcd6ca63a
Pavlin Radoslavov [Thu, 13 Jul 2017 18:13:55 +0000 (18:13 +0000)]
Merge "Allocate buffers of the right size when BT_HDR is included" into mnc-dev
am:
d2a3649d6e
Change-Id: I781ce0eb5e6ea5b8b8fb029afe6caf81bd9ca9fb
Pavlin Radoslavov [Thu, 13 Jul 2017 18:13:38 +0000 (18:13 +0000)]
Disable PAN Reverse Tethering when connection originated by the Remote
am:
f7a7f7a948
Change-Id: I5d1c8050de38dde922f9891e70574205422ee7be
Pavlin Radoslavov [Thu, 13 Jul 2017 18:06:58 +0000 (18:06 +0000)]
Merge "Disable PAN Reverse Tethering when connection originated by the Remote" into nyc-dev
am:
ee18c2bdd9
Change-Id: I077fed75c11c360dd38d4988f08dca4dd8ddf604
Pavlin Radoslavov [Thu, 13 Jul 2017 18:06:36 +0000 (18:06 +0000)]
Allocate buffers of the right size when BT_HDR is included
am:
510697a0d7
Change-Id: I5ca796fc392413dbf7f89332d1172904f980fab5
TreeHugger Robot [Thu, 13 Jul 2017 18:05:30 +0000 (18:05 +0000)]
Merge "Add missing packet length checks while parsing BNEP control packets" into mnc-dev
TreeHugger Robot [Thu, 13 Jul 2017 18:05:09 +0000 (18:05 +0000)]
Merge "Add missing continuation offset check for SDP continuation requests" into mnc-dev
TreeHugger Robot [Thu, 13 Jul 2017 18:04:48 +0000 (18:04 +0000)]
Merge "Allocate buffers of the right size when BT_HDR is included" into mnc-dev
TreeHugger Robot [Thu, 13 Jul 2017 18:02:23 +0000 (18:02 +0000)]
Merge "Disable PAN Reverse Tethering when connection originated by the Remote" into nyc-dev
Pavlin Radoslavov [Thu, 13 Jul 2017 00:33:42 +0000 (17:33 -0700)]
Add a missing check for PAN buffer size before copying data
Bug:
63146237
Test: External script
Change-Id: I3e9c8a767a8a2a80ff56ccb48c56ca0d4b8c3402
Merged-In: I3e9c8a767a8a2a80ff56ccb48c56ca0d4b8c3402
(cherry picked from commit
1d909399cb4259243dac2e531e3ce6ca1afa77e7)
(cherry picked from commit
aa486ad8b5ad6eaef732e5fa7f151495c8c3faf2)
(cherry picked from commit
a8a6a17fdfc8d930ba4ad18f92cf4453cc1a219e)
(cherry picked from commit
d1145e0af3507e37d4bd25f1833e22c5c716f0ac)
Pavlin Radoslavov [Thu, 13 Jul 2017 01:39:31 +0000 (18:39 -0700)]
Disable PAN Reverse Tethering when connection originated by the Remote
* Check for valid interactions between the three PAN profile roles per
Table 1 in PAN Profile v1.0 spec.
* Explicitly disable connections to the local PANU if the remote is
not PANU.
Bug:
63145701
Test: External script
Change-Id: I29a7e404ba7e4453b6a7c59148a2b3eb7395303a
Merged-In: I29a7e404ba7e4453b6a7c59148a2b3eb7395303a
(cherry picked from commit
9aea2c2f92dd5245f6b35d564ce8e471fec2b4ec)
(cherry picked from commit
3f2ee5b546b65b5b021779588316249276ed3827)
(cherry picked from commit
40c7cefb12ac1a70bf7b1c770c1ab21a5b3f229e)
(cherry picked from commit
f7a7f7a948e38195e8ca897785ac5d489082f0cc)
Pavlin Radoslavov [Thu, 6 Jul 2017 20:39:02 +0000 (13:39 -0700)]
Allocate buffers of the right size when BT_HDR is included
Bug:
63146105
Test: External script
Change-Id: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
Merged-In: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
(cherry picked from commit
d88838a7237cd672d87b6b9cc8d56fff625fd1d5)
(cherry picked from commit
b648c7dfe45c57842d58576f558fdf8edff10bec)
(cherry picked from commit
338e0485940ab278e6a2dc12285ba0798b79cfa4)
Pavlin Radoslavov [Thu, 13 Jul 2017 02:10:12 +0000 (19:10 -0700)]
Add missing packet length checks while parsing BNEP control packets
Bug:
63146237
Test: External script
Change-Id: Ie778f3c99df81c85ed988f3af89b4edbcc2eeb99
Merged-In: Ie778f3c99df81c85ed988f3af89b4edbcc2eeb99
(cherry picked from commit
7feaeb006941a1494d7cdc0a2ffc4bb1004b38b4)
(cherry picked from commit
6d415839da570b94b0763f6ab444f0dd1321fc33)
(cherry picked from commit
c68554feb3ddfd31cdec6d81a4b73a959c1b2a09)
(cherry picked from commit
3775b3c49e5d62349fd1f3dfb743fabadb43ea75)
Pavlin Radoslavov [Thu, 13 Jul 2017 01:56:03 +0000 (18:56 -0700)]
Add missing continuation offset check for SDP continuation requests
Bug:
63146698
Test: External script
Change-Id: Iea52f1689dc12bfe0d4b57996f17db4bc3bd5983
Merged-In: Iea52f1689dc12bfe0d4b57996f17db4bc3bd5983
(cherry picked from commit
e776c834768bedd043ace7e5714390b61c96a248)
(cherry picked from commit
10ce685cb025f6854be4ecc5329f2f684fd9ea5d)
Pavlin Radoslavov [Thu, 13 Jul 2017 01:39:31 +0000 (18:39 -0700)]
Disable PAN Reverse Tethering when connection originated by the Remote
* Check for valid interactions between the three PAN profile roles per
Table 1 in PAN Profile v1.0 spec.
* Explicitly disable connections to the local PANU if the remote is
not PANU.
Bug:
63145701
Test: External script
Change-Id: I29a7e404ba7e4453b6a7c59148a2b3eb7395303a
Merged-In: I29a7e404ba7e4453b6a7c59148a2b3eb7395303a
(cherry picked from commit
9aea2c2f92dd5245f6b35d564ce8e471fec2b4ec)
(cherry picked from commit
3f2ee5b546b65b5b021779588316249276ed3827)
(cherry picked from commit
40c7cefb12ac1a70bf7b1c770c1ab21a5b3f229e)
Pavlin Radoslavov [Thu, 13 Jul 2017 00:33:42 +0000 (17:33 -0700)]
Add a missing check for PAN buffer size before copying data
Bug:
63146237
Test: External script
Change-Id: I3e9c8a767a8a2a80ff56ccb48c56ca0d4b8c3402
Merged-In: I3e9c8a767a8a2a80ff56ccb48c56ca0d4b8c3402
(cherry picked from commit
1d909399cb4259243dac2e531e3ce6ca1afa77e7)
(cherry picked from commit
aa486ad8b5ad6eaef732e5fa7f151495c8c3faf2)
(cherry picked from commit
a8a6a17fdfc8d930ba4ad18f92cf4453cc1a219e)
Pavlin Radoslavov [Thu, 6 Jul 2017 20:39:02 +0000 (13:39 -0700)]
Allocate buffers of the right size when BT_HDR is included
Bug:
63146105
Test: External script
Change-Id: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
Merged-In: I1f2c871e3fcf57aabdad9d07905e6dae643bd496
(cherry picked from commit
d88838a7237cd672d87b6b9cc8d56fff625fd1d5)
(cherry picked from commit
b648c7dfe45c57842d58576f558fdf8edff10bec)
Jack He [Tue, 11 Apr 2017 22:23:08 +0000 (22:23 +0000)]
Check LE advertising data length before caching advertising records am:
1bef3546a6 am:
e6620d18cf am:
585e0c08f5 am:
005eb1d305
am:
7752061901
Change-Id: I1f821df2a72958ed17ce5bf8baed431a52dfb087
Jack He [Tue, 11 Apr 2017 22:18:07 +0000 (22:18 +0000)]
Check LE advertising data length before caching advertising records am:
1bef3546a6 am:
e6620d18cf am:
585e0c08f5
am:
005eb1d305
Change-Id: Ic4f826e4f963f969c360fe39c6e720c3fb013d23
Jack He [Tue, 11 Apr 2017 22:13:06 +0000 (22:13 +0000)]
Check LE advertising data length before caching advertising records am:
1bef3546a6 am:
e6620d18cf
am:
585e0c08f5
Change-Id: If70a5f9b56845e758c2a2a3150936a72cac9f438
Jack He [Tue, 11 Apr 2017 22:08:06 +0000 (22:08 +0000)]
Check LE advertising data length before caching advertising records am:
1bef3546a6
am:
e6620d18cf
Change-Id: I412c0dd7854d7f6157e1974e285078909543bb41
Jack He [Tue, 11 Apr 2017 22:03:05 +0000 (22:03 +0000)]
Check LE advertising data length before caching advertising records
am:
1bef3546a6
Change-Id: Ibbf6183833d7f00937742fa337a04569c4ef3c2f
Jack He [Thu, 6 Apr 2017 00:59:58 +0000 (17:59 -0700)]
Check LE advertising data length before caching advertising records
Bug:
33899337
Test: make, receive LE advertising
Change-Id: I06b249ac5cabdef64528deda07b8bae749e1d2fd
(cherry picked from commit
d57adbc350fdee4f27b82c9e39a14bd745d92320)
Pavlin Radoslavov [Wed, 15 Mar 2017 05:41:49 +0000 (05:41 +0000)]
resolve merge conflicts of
a3ee2e35 to nyc-dev
am:
a33dd28064
Change-Id: I081f113d8908bb775f56c25beb105a3311b0affb
Pavlin Radoslavov [Tue, 14 Mar 2017 21:46:15 +0000 (14:46 -0700)]
resolve merge conflicts of
a3ee2e35 to nyc-dev
Bug:
34946955
Change-Id: Ieff690edd3aa527a0639483ec8e1e3b661f0ecc4
Merged-In: I0b6f50dee05a58db8c043b4d01fb58c9acbeede9
Pavlin Radoslavov [Tue, 14 Mar 2017 21:10:16 +0000 (21:10 +0000)]
Check the HCI length before extracting the L2CAP length and CID am:
33c68c82c1 am:
172f0d8f7c
am:
ca64d3d38b
Change-Id: I239b72b4cc81728c3e859b7f4efcb820c9d8fef9
Pavlin Radoslavov [Tue, 14 Mar 2017 21:05:16 +0000 (21:05 +0000)]
Check the HCI length before extracting the L2CAP length and CID am:
33c68c82c1
am:
172f0d8f7c
Change-Id: Ifb002936f93d85d635ab76ddf52c0ddb44cb9d3e
Pavlin Radoslavov [Tue, 14 Mar 2017 20:59:46 +0000 (20:59 +0000)]
Check the HCI length before extracting the L2CAP length and CID
am:
33c68c82c1
Change-Id: I1f94530ef90162747ef6a62c3a601856ea1d6672
Pavlin Radoslavov [Wed, 8 Mar 2017 02:48:21 +0000 (18:48 -0800)]
Check the HCI length before extracting the L2CAP length and CID
Bug:
34946955
Test: A2DP streaming to a headset
Change-Id: I0b6f50dee05a58db8c043b4d01fb58c9acbeede9
(cherry picked from commit
ecc0835114cbae3033d8b0e25bd8b443880d5077)
Andre Eisenbach [Mon, 29 Aug 2016 22:05:26 +0000 (22:05 +0000)]
Merge "Disable auto-pairing for hands-free devices" into nyc-dev
am:
fb309b3ce7
Change-Id: Ib7494cc47ff0e93f7f20a12dc79695697d2eecf0
Andre Eisenbach [Mon, 29 Aug 2016 22:05:26 +0000 (22:05 +0000)]
Disable auto-pairing for hands-free devices
am:
d2a37effc2
Change-Id: I87c0ba767d7dcf91cfd6cb4903fea4efd6df392b
TreeHugger Robot [Mon, 29 Aug 2016 21:51:21 +0000 (21:51 +0000)]
Merge "Disable auto-pairing for hands-free devices" into nyc-dev
Andy Hung [Mon, 29 Aug 2016 21:12:22 +0000 (21:12 +0000)]
audio_a2dp_hw: Always update frame counter in out_write
am:
5274ab7a31
Change-Id: I6f40e0c813cbc7fe9801903f8c2cbfb08e05f6c0
Andy Hung [Thu, 28 Jul 2016 17:45:54 +0000 (10:45 -0700)]
audio_a2dp_hw: Always update frame counter in out_write
Required now that we always return success.
Bug:
30025777
Change-Id: I7db51321672c128039545cc0fb604c615f169bc3
(cherry picked from commit
f4a37b255d1d6fa4cf7cefe2aeb1c3f4fdf33f3c)
Jakub Pawlowski [Mon, 18 Jul 2016 16:06:49 +0000 (09:06 -0700)]
Make gatt_attr use opportunistic connection
This patch creates new connection mode - opportunistic connection. When
such connection is made, no call to gatt_update_app_hold_link_status
will be made when it's started.
This means that connecting and disconnecting in this mode won't trigger
disconnect timer. When other, app creates regular connection and then
disconnects, the physical connection might get disconnected.
Opportunistic connection is used only for code setting CCC right now.
Bug:
30186455
Change-Id: Ia5be7682b6c3dcb4993060f818dee603aef3e19e
Jakub Pawlowski [Thu, 16 Jun 2016 15:16:48 +0000 (08:16 -0700)]
GATT: don't update link status for apps that were never connected
Right now, in GATT_Deregister we make a call to
gatt_update_app_use_link_flag, which might result in a call to
GATT_SetIddleTimeout on links that this client was never connected to.
In order to fix that, we must check if gatt_update_app_hold_link_status
made any changes to p_tcb->app_hold_link. If not, then skip updating
the timer.
Bug:
30186455
Change-Id: I6f18ec7fe4e80e048adc9e360cae703b7d64d62a
Satomi [Tue, 9 Aug 2016 16:30:11 +0000 (09:30 -0700)]
Rvert "Register for Service Changed notifications for untrusted devices"
This reverts commit
5f0e23d532f4f90d081ccc0e294f404eb5e5b688.
Instead of reusing service discovery data, gatt profile initiates
discovery by service uuid before regular service discovery is started,
and both discovery procedures interfere with each other.
As a result, link is dropped.
Bug:
30462943
Bug:
30481143
Change-Id: Ic63339f4f46eda70e575a4103974766d54a9d624
Signed-off-by: Satomi <michitsuta@casio.co.jp>
Jakub Pawlowski [Fri, 5 Aug 2016 12:32:37 +0000 (05:32 -0700)]
Fix APR crashes in read rssi callback
When read RSSI timeouts, callback is called with NULL result. This was
causing crash.
Bug:
30562545
Change-Id: If379c2de4ceab48c021601851a8c83f995440460
Andy Hung [Thu, 28 Jul 2016 23:40:16 +0000 (23:40 +0000)]
Merge "audio_a2dp_hw: Always update frame counter in out_write" into nyc-mr1-dev
Andy Hung [Thu, 28 Jul 2016 17:45:54 +0000 (10:45 -0700)]
audio_a2dp_hw: Always update frame counter in out_write
Required now that we always return success.
Bug:
30025777
Change-Id: I7db51321672c128039545cc0fb604c615f169bc3
Ayan Ghosh [Fri, 22 Jul 2016 09:41:11 +0000 (15:11 +0530)]
Proper handling of AV connection collision
Use case:
1. Pair to Remote
2. Turn OFF/ON BT on DUT
3. After DUT's BT is turned ON, Remote would reconnect to DUT
Failure:
Bluetooth settings UI continues to display Connecting when
BT was Turned OFF and ON.
Root cause:
- This is a connection collision case where remote is not responding
to DUT initiated SDP attribute fetch request for AV. AV holds outgoing
connection for sometime and meanwhile remote starts AV connection
from its end. Then DUT disconnects the SDP channel after a second
without waiting to fetch requested info, and this confuses DUT's AV
state machine. The outgoing connection could not proceed as incoming
AV L2CAP connects, because DUT's AV state machine is not equipped
with handling this scenario. On incoming connection timer expiry, it
does not start AV media channel as it finds AV Open has not been done
from upper layer after incoming L2CAP got connected.
- When the incoming path 2s timer expires, the DUT checks whether Open
has been called after incoming state is set. This is not the case here,
because Open was triggered earlier as as part of the outgoing
connection. As a result, A2DP cannot connect at all.
Fix:
- Properly set collision flags for handling AV connection collision.
- Update BTA AV handle even when BTIF AV state machine is yet to be built.
Bug:
30362987
Change-Id: I02a3adb62479b0f762bc792a5727d06e11eaaa52
(cherry picked from commit
db1e3a5fbb41cd1faf572c5f89ec9212c5ff2986)
Tom Turney [Mon, 25 Jul 2016 21:23:30 +0000 (21:23 +0000)]
Revert "Remove position dependent lookup tables in AT command parser"
This reverts commit
1e7afc829bde75489d14669b2baea1e9c47b1d56.
Revert Reason: This CL causes regressions b/
30367872, b/
30368041,
b/
30368763.
Change-Id: I48da5caac1e9fe32462c236385f768b896fa6542
Andre Eisenbach [Sat, 23 Jul 2016 06:15:11 +0000 (23:15 -0700)]
Remove position dependent lookup tables in AT command parser
The various position dependent lookup tables in the AT command parser
were out of sync, causing invalid responses to the AT+CBPS command for
example.
This patch gets rid of positionally dependent enums for simple lookup
tables that correlate all the values for easier, less error prone
maintenance of the related tables.
Change-Id: I84f7d4f4a803e6e52bf2021c6c74917e90bbc846
Fixes:
29978908
ugo_yu [Fri, 3 Jun 2016 10:04:24 +0000 (18:04 +0800)]
GATT: Deregister notification when a GATT connection is closed
Precondition:
1. Pair with specific HOGP mouse.
Steps:
1. Pair with HOGP mouse (iBuffalo BSMBB09DS)
2. Unpair the mouse.
3. Pair the mouse again.
Failure:
Pairing is successful, but the mouse won't connect.
Root Cause:
Some HOGP mice send notifications before the stack writes the
client characteristic configuration descriptor.
The Bluetooth stack doesn't deregister these notifiactions
when disconnecting.
Fix:
Deregister notifications when the GATT connection closes.
Fixes:
29111689
Change-Id: I520faeaa5fc396381cb248d3a2c49efbffa12261
Andre Eisenbach [Fri, 15 Jul 2016 17:50:32 +0000 (10:50 -0700)]
Make parameter set S4 default for eSCO
Bug:
29615817
Change-Id: I5256b31a746433f10c2e7de1629952f668c99d16
Subramanian Srinivasan [Mon, 16 May 2016 18:14:03 +0000 (11:14 -0700)]
Process Gatt read multiple response properly
The Gatt server multi response queue is made NULL after each Gatt
server response is sent by BT stack in response to the remote Gatt
client's request. But the multi response queue is not initialized
again to process subsequent read multiple Gatt server responses.
Hence, the BT stack does not send Gatt server responses for the
subsequent read multiple requests from remote device which inturn
leads to disconnection. This change would process read multiple
responses by initializing the queue when it is null.
Some of Bluetooth certification test cases involve testing
Gatt server's capability to process and send read multiple
response.
Test case: TC_GAR_SR_BV_05_C
This change also cleans up unnecessary initialization and freeing
of multi rsp queue. This change makes sure that the stack initializes
multi rsp queue only when it is necessary(ie only when the Gatt
multiple read response is being processed).
Bug:
29011255
Change-Id: Ia3e2e1569ee16cac9c518f95501945257b9fb7fd
(cherry picked from commit
3737592a7846766083041e81d72a2fab0b27fb38)
Ajay Panicker [Wed, 29 Jun 2016 23:39:07 +0000 (16:39 -0700)]
Add logs for AVRCP commands that originate from a remote device
Change-Id: I02b213913685d831bfe00e1938baef953428e048