Merge "RESTRICT AUTOMERGE Revert "Fix a type confusion bug in bta_av_setconfig_rej"" into tm-dev am: 4c2af764 am: aec62eaa

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/24131190



Change-Id: I2f65b31299b08674893918aa9e182a24563c904e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

RESTRICT AUTOMERGE Revert "Fix a type confusion bug in bta_av_setconfig_rej" am: 5a4c8f3b am: d3b74266

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/24131190



Change-Id: Ia2c0d7f8f51b72428a70c112ccc05f4e3af85773
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Merge "RESTRICT AUTOMERGE Revert "Fix a type confusion bug in bta_av_setconfig_rej"" into tm-dev am: 4c2af764

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/24131190



Change-Id: I5f3f936e4bc380afa27390cdf79d1d2094e63b2f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/24131190



Change-Id: I4d75a7c0014b1984ee14d3313792368d01632517
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

This reverts commit bbd88e88.

Reason for revert: b/281788858

Merged-In: Id5f74a0f9c27f67050ffef497bb42580f30bfe38
Merged-In: If6fb57064b5b2da40842e2c1cf95aadc6f0351b6
Merged-In: I608fd8b8838a2476bf0b1d9dbb86c75032eec2f3

Change-Id: I0f45c87ba5f0b2c84843e568ca117439b42d1ed3

Auto-generated-cl: translation import
Change-Id: I7a08749ffa8935e3fda79ee74be43661cd6d35b5

Auto-generated-cl: translation import
Change-Id: Ia98ec0294bf78e404fc5162a4933d1a30f46dec2

Auto-generated-cl: translation import
Change-Id: Iae6d579461dc65525d99e933ba5071597e127a79

Test: atest BluetoothInstrumentationTests
Bug: 271351629
(cherry picked from https://android-review.googlesource.com/q/commit:95216457f02bb074eddf40322337f70dfa2d4e1c)
Merged-In: I8be0a5bcbb8c26e3ef178bcb25973783045b9f31
Change-Id: I8be0a5bcbb8c26e3ef178bcb25973783045b9f31

Auto-generated-cl: translation import
Change-Id: I6a9bd036dad568d53fa671de675c613c30c88167

Auto-generated-cl: translation import
Change-Id: I2345c2b02fb7b4ebb75c1d012fe77bd0e6fd50f7

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22581496



Change-Id: I89af4509c56b2c6c8c836e14e004209314abb38b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22581496



Change-Id: Ib7c9450d1ead66dd16c00ae3591c2c7efc7b7a7f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21609715



Change-Id: I9dd980ac9357ade7cdcd885e81145ffab9020e4b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21609715



Change-Id: I8706187fb778ea1ca35291b08773fb52181dc335
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Peer devices with BTM_SEC_NAME_KNOWN flag set have their
device names stored in sec_bd_name. If RNR is skipped
for this kind of device, bat_dm_search_cb.peer_name would
be empty and sec_bd_name shall be used instead.
Therefore, this patch uses bta_dm_get_remname() to fill up
the tBTA_DM_MSG in bta_dm_discover_device() and applies the
same indirection layer to similar situations for consistency.

Bug: 283178131
Tag: #floss
Test: Manual test - pairing with the problematic keyboard in the specific way problem was introduced
(cherry picked from https://android-review.googlesource.com/q/commit:fdeaf43e1508ba92d5455a636994b906a7b915db)
Merged-In: I7a297ff9a53ccbd6f3b9283e61ed208b000e6678
Change-Id: I7a297ff9a53ccbd6f3b9283e61ed208b000e6678

Auto-generated-cl: translation import
Change-Id: I5fec6f37af61825ce9f20a4b3d7c471f6629a3e3

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22726306



Change-Id: Id4949daa2c63b7ab132e23efe4f9c2e21541864e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22726306



Change-Id: I5dc67f531b235302c6bf8904609af1d7e0d869b9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152778



Change-Id: Ia79662831bfe5d8a40a7c9b63e9f2eaf15b19852
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152778



Change-Id: I0d6c9381f451aba707f54c1da27319b5ee097a0d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Auto-generated-cl: translation import
Change-Id: If5e4e4cd37f0ea71f1344c17979fdade36535e00

Bug: 280633699
Test: manual
Ignore-AOSP-First: security
Tag: #security
Change-Id: Iaa4d603921fc4ffb8cfb5783f99ec0963affd6a2

Local variables tracking structure size in build_read_multi_rsp are of
uint16 type but accept a full uint16 range from function arguments while
appending a fixed-length offset.  This can lead to an integer overflow
and unexpected behavior.

Change the locals to size_t, and add a check during reasssignment.

Bug: 273966636
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I3a74bdb0d003cb6bf4f282615be8c68836676715
(cherry picked from commit 70a4d628)

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23139401



Change-Id: Ica98719163a78784335dab78af44bb5cdc615fbf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23139401



Change-Id: I7c10e2ad52871e80aedb37b65500498fe494908f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

[automerger skipped] [resolved conflict] Fix multiple OOB bugs resulted from tx mtu in EATT am: ea76b7d9 am: 3b942b84 -s ours

am skip reason: Merged-In Ia06c9a17f2daa5ce4c32cffa536777f47774cf31 with SHA-1 282d4a18 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23228877



Change-Id: I43d2bde46740879d4114e2b9a07c9850b1825b52
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152794



Bug: 271335899
Test: manual
Ignore-AOSP-First: security
Tag: #security
Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31
Change-Id: I02f1aec42e0c12c8f53fe03090b0c40c6e8e51c5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

The tx mtu in EATT can be controlled by remote device. With malicious
mtu values, it is possible to trigger integer overflow and
OOB write at multiple places (see the bug below).

This fix enforces a max tx mtu in EATT.

Bug: 271335899
Test: manual
Ignore-AOSP-First: security
Tag: #security
Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31
Change-Id: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31