diff options
| -rw-r--r-- | system/btif/src/btif_hf_client.cc | 1 | ||||
| -rw-r--r-- | system/osi/src/allocator.cc | 2 | ||||
| -rw-r--r-- | system/stack/avrc/avrc_pars_tg.cc | 7 | ||||
| -rw-r--r-- | system/stack/include/hci_evt_length.h | 2 |
4 files changed, 4 insertions, 8 deletions
diff --git a/system/btif/src/btif_hf_client.cc b/system/btif/src/btif_hf_client.cc index ec5eb2ed55..0826368138 100644 --- a/system/btif/src/btif_hf_client.cc +++ b/system/btif/src/btif_hf_client.cc @@ -166,6 +166,7 @@ static void btif_in_hf_client_generic_evt(uint16_t event, char* p_param) { btif_hf_client_cb_t* cb = btif_hf_client_get_cb_by_bda(*bd_addr); if (cb == NULL || !is_connected(cb)) { BTIF_TRACE_ERROR("%s: failed to find block for bda", __func__); + return; } BTIF_TRACE_EVENT("%s: event=%d", __func__, event); diff --git a/system/osi/src/allocator.cc b/system/osi/src/allocator.cc index 71dd9d41aa..20c843b950 100644 --- a/system/osi/src/allocator.cc +++ b/system/osi/src/allocator.cc @@ -57,6 +57,7 @@ char* osi_strndup(const char* str, size_t len) { } void* osi_malloc(size_t size) { + CHECK(static_cast<ssize_t>(size) >= 0); size_t real_size = allocation_tracker_resize_for_canary(size); void* ptr = malloc(real_size); CHECK(ptr); @@ -64,6 +65,7 @@ void* osi_malloc(size_t size) { } void* osi_calloc(size_t size) { + CHECK(static_cast<ssize_t>(size) >= 0); size_t real_size = allocation_tracker_resize_for_canary(size); void* ptr = calloc(1, real_size); CHECK(ptr); diff --git a/system/stack/avrc/avrc_pars_tg.cc b/system/stack/avrc/avrc_pars_tg.cc index 71cebef1f2..6aa4a31e14 100644 --- a/system/stack/avrc/avrc_pars_tg.cc +++ b/system/stack/avrc/avrc_pars_tg.cc @@ -118,13 +118,6 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg, if (p_msg->vendor_len == 0) return AVRC_STS_NO_ERROR; if (p_msg->p_vendor_data == NULL) return AVRC_STS_INTERNAL_ERR; - if (p_msg->vendor_len < 4) { - android_errorWriteLog(0x534e4554, "168712382"); - AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4", - __func__, p_msg->vendor_len); - return AVRC_STS_INTERNAL_ERR; - } - p = p_msg->p_vendor_data; p_result->pdu = *p++; AVRC_TRACE_DEBUG("%s pdu:0x%x", __func__, p_result->pdu); diff --git a/system/stack/include/hci_evt_length.h b/system/stack/include/hci_evt_length.h index 5bacdb16c3..8f8e661c21 100644 --- a/system/stack/include/hci_evt_length.h +++ b/system/stack/include/hci_evt_length.h @@ -84,7 +84,7 @@ static const uint8_t hci_event_parameters_minimum_length[] = { 10, // 0x3B - HCI_User_Passkey_Notification Event 7, // 0x3C - HCI_Keypress_Notification Event 14, // 0x3D - HCI_Remote_Host_Supported_Features_Notification Event - 0, // 0x3E - LE Meta event + 1, // 0x3E - LE Meta event 0, // 0x3F - N/A 2, // 0x40 - HCI_Physical_Link_Complete Event 1, // 0x41 - HCI_Channel_Selected Event |