Skip to content
Snippets Groups Projects
Commit 86934312 authored by Android Build Coastguard Worker's avatar Android Build Coastguard Worker
Browse files

Merge cherrypicks of ['googleplex-android-review.googlesource.com/25558746']...

Merge cherrypicks of ['googleplex-android-review.googlesource.com/25558746'] into security-aosp-udc-release.

Change-Id: Ib14b601ff6de57765d2ee683c50df91d2a58b74b
parents 8e1f7414 354b019b
No related branches found
No related tags found
No related merge requests found
......@@ -287,79 +287,46 @@ static BT_HDR* attp_build_opcode_cmd(uint8_t op_code) {
static BT_HDR* attp_build_value_cmd(uint16_t payload_size, uint8_t op_code,
uint16_t handle, uint16_t offset,
uint16_t len, uint8_t* p_data) {
uint8_t *p, *pp, *p_pair_len;
size_t pair_len;
size_t size_now = 1;
#define CHECK_SIZE() do { \
if (size_now > payload_size) { \
LOG(ERROR) << "payload size too small"; \
osi_free(p_buf); \
return nullptr; \
} \
} while (false)
uint8_t *p, *pp, pair_len, *p_pair_len;
BT_HDR* p_buf =
(BT_HDR*)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET);
p = pp = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET;
CHECK_SIZE();
UINT8_TO_STREAM(p, op_code);
p_buf->offset = L2CAP_MIN_OFFSET;
p_buf->len = 1;
if (op_code == GATT_RSP_READ_BY_TYPE) {
p_pair_len = p;
pair_len = len + 2;
size_now += 1;
CHECK_SIZE();
// this field will be backfilled in the end of this function
UINT8_TO_STREAM(p, pair_len);
p_buf->len += 1;
}
if (op_code != GATT_RSP_READ_BLOB && op_code != GATT_RSP_READ) {
size_now += 2;
CHECK_SIZE();
UINT16_TO_STREAM(p, handle);
p_buf->len += 2;
}
if (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_RSP_PREPARE_WRITE) {
size_now += 2;
CHECK_SIZE();
UINT16_TO_STREAM(p, offset);
p_buf->len += 2;
}
if (len > 0 && p_data != NULL && payload_size > size_now) {
if (len > 0 && p_data != NULL) {
/* ensure data not exceed MTU size */
if (payload_size - size_now < len) {
len = payload_size - size_now;
if (payload_size - p_buf->len < len) {
len = payload_size - p_buf->len;
/* update handle value pair length */
if (op_code == GATT_RSP_READ_BY_TYPE) {
pair_len = (len + 2);
}
if (op_code == GATT_RSP_READ_BY_TYPE) *p_pair_len = (len + 2);
LOG(WARNING) << StringPrintf(
"attribute value too long, to be truncated to %d", len);
}
size_now += len;
CHECK_SIZE();
ARRAY_TO_STREAM(p, p_data, len);
p_buf->len += len;
}
// backfill pair len field
if (op_code == GATT_RSP_READ_BY_TYPE) {
if (pair_len > UINT8_MAX) {
LOG(ERROR) << "pair_len greater than" << UINT8_MAX;
osi_free(p_buf);
return nullptr;
}
*p_pair_len = (uint8_t) pair_len;
}
#undef CHECK_SIZE
p_buf->len = (uint16_t) size_now;
return p_buf;
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment