Merge 8be4809b85e1608b560b6fd4ea73609b04c24e1d on remote branch

Change-Id: I6d1d4115f8f8e5f6e5e5b4128f3489fc04e194d6

7 files changed, 25 insertions, 7 deletions

diff --git a/audio_hal_interface/aidl/a2dp_encoding.cc b/audio_hal_interface/aidl/a2dp_encoding.cc
index 26f6d9ef0..722d09334 100644
--- a/audio_hal_interface/aidl/a2dp_encoding.cc
+++ b/audio_hal_interface/aidl/a2dp_encoding.cc
@@ -625,7 +625,8 @@ bool setup_codec() {
   }
 
   AudioConfiguration audio_config{};
-  if (active_hal_interface->GetTransportInstance()->GetSessionType() ==
+  if (active_hal_interface && active_hal_interface->GetTransportInstance() &&
+      active_hal_interface->GetTransportInstance()->GetSessionType() ==
       SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
     audio_config.set<AudioConfiguration::a2dpConfig>(codec_config);
   } else {
diff --git a/bta/dm/bta_dm_act.cc b/bta/dm/bta_dm_act.cc
index 5f86f9f7b..6e3773f65 100644
--- a/bta/dm/bta_dm_act.cc
+++ b/bta/dm/bta_dm_act.cc
@@ -1631,7 +1631,7 @@ void bta_dm_discover(tBTA_DM_MSG* p_data) {
   bta_dm_search_cb.transport = p_data->discover.transport;
 
   char* p_name = BTM_SecReadDevName(p_data->discover.bd_addr);
-  if ((p_name != NULL) && (p_data->discover.transport == BT_TRANSPORT_BR_EDR)) {
+  if (p_name != NULL) {
     strlcpy((char*)bta_dm_search_cb.peer_name, p_name, BD_NAME_LEN + 1);
     bta_dm_search_cb.name_discover_done = true;
   } else {
diff --git a/bta/hh/bta_hh_act.cc b/bta/hh/bta_hh_act.cc
index 68272571b..0df7041bd 100644
--- a/bta/hh/bta_hh_act.cc
+++ b/bta/hh/bta_hh_act.cc
@@ -464,6 +464,7 @@ void bta_hh_sdp_cmpl(tBTA_HH_DEV_CB* p_cb, tBTA_HH_DATA* p_data) {
     (*bta_hh_cb.p_cback)(BTA_HH_OPEN_EVT, (tBTA_HH*)&conn_dat);
 
     /* move state machine W4_CONN ->IDLE */
+    APPL_TRACE_WARNING("Device handle: [%d]", p_cb->hid_handle);
     bta_hh_sm_execute(p_cb, BTA_HH_API_CLOSE_EVT, NULL);
 
     /* if this is an outgoing connection to an unknown device, clean up cb */
@@ -1026,6 +1027,7 @@ void bta_hh_maint_dev_act(tBTA_HH_DEV_CB* p_cb, tBTA_HH_DATA* p_data) {
 #if (BTA_HH_LE_INCLUDED == TRUE)
       if (p_cb->is_le_device) {
         bta_hh_le_remove_dev_bg_conn(p_cb);
+        APPL_TRACE_WARNING("Device Handle: [%d]", p_cb->hid_handle);
         bta_hh_sm_execute(p_cb, BTA_HH_API_CLOSE_EVT, NULL);
         bta_hh_clean_up_kdev(p_cb);
       } else
diff --git a/bta/hh/bta_hh_main.cc b/bta/hh/bta_hh_main.cc
index 765787b3f..d31882488 100644
--- a/bta/hh/bta_hh_main.cc
+++ b/bta/hh/bta_hh_main.cc
@@ -313,7 +313,11 @@ void bta_hh_sm_execute(tBTA_HH_DEV_CB* p_cb, uint16_t event,
 
             APPL_TRACE_WARNING("device handle: [%d]",
                                cback_data.dev_status.handle);
-            osi_free_and_reset((void**)&p_data);
+            if (p_data->api_disc.hdr.layer_specific != BTA_HH_INVALID_HANDLE) {
+              osi_free_and_reset((void**)&p_data);
+            } else {
+              APPL_TRACE_WARNING("Invalid device handle: [%d]", p_data->api_disc.hdr.layer_specific);
+            }
           }
           break;
 
@@ -325,7 +329,11 @@ void bta_hh_sm_execute(tBTA_HH_DEV_CB* p_cb, uint16_t event,
                 (uint8_t)p_data->api_get_dscp.hdr.layer_specific;
             APPL_TRACE_WARNING("device handle: [%d]",
                                cback_data.dev_status.handle);
-            osi_free_and_reset((void**)&p_data);
+            if (p_data->api_get_dscp.hdr.layer_specific != BTA_HH_INVALID_HANDLE) {
+              osi_free_and_reset((void**)&p_data);
+            } else {
+              APPL_TRACE_WARNING("Invalid Device Handle: [%d]", p_data->api_get_dscp.hdr.layer_specific);
+            }
           }
           break;
 
diff --git a/btif/src/btif_av.cc b/btif/src/btif_av.cc
index 10e1241b7..909e46dd1 100644
--- a/btif/src/btif_av.cc
+++ b/btif/src/btif_av.cc
@@ -5484,6 +5484,12 @@ static bt_status_t codec_config_source(const RawAddress& bd_addr,
   std::unique_lock<std::mutex> guard(isDevUiReq_mutex_);
   isDevUiReq = false;
   codec_cfg_change = false;
+
+  if (index >= btif_max_av_clients || index < 0) {
+    BTIF_TRACE_ERROR("%s(): Invalid index = %d",__func__, index);
+    return BT_STATUS_FAIL;
+  }
+
   for (auto cp : codec_preferences) {
     BTIF_TRACE_DEBUG(
         "%s: codec_type=%d codec_priority=%d "
diff --git a/btif/src/btif_hh.cc b/btif/src/btif_hh.cc
index f071356a7..ad9b501a1 100644
--- a/btif/src/btif_hh.cc
+++ b/btif/src/btif_hh.cc
@@ -920,15 +920,16 @@ static void btif_hh_upstreams_evt(uint16_t event, char* p_param) {
 
     case BTA_HH_GET_RPT_EVT: {
       BT_HDR* hdr = p_data->hs_data.rsp_data.p_rpt_data;
+      tBTA_HH_STATUS status = p_data->hs_data.status;
       uint8_t* data = NULL;
       uint16_t len = 0;
 
       BTIF_TRACE_DEBUG("BTA_HH_GET_RPT_EVT: status = %d, handle = %d",
-                       p_data->hs_data.status, p_data->hs_data.handle);
+                       status, p_data->hs_data.handle);
       p_dev = btif_hh_find_connected_dev_by_handle(p_data->hs_data.handle);
       if (p_dev) {
         /* p_rpt_data is NULL in HANDSHAKE response case */
-        if (hdr) {
+        if (status == BTA_HH_OK && hdr) {
           data = (uint8_t*)(hdr + 1) + hdr->offset;
           len = hdr->len;
           HAL_CBACK(bt_hh_callbacks, get_report_cb,
diff --git a/stack/l2cap/l2c_link.cc b/stack/l2cap/l2c_link.cc
index 90fb845d2..614d36c47 100644
--- a/stack/l2cap/l2c_link.cc
+++ b/stack/l2cap/l2c_link.cc
@@ -433,7 +433,7 @@ bool l2c_link_hci_disc_comp(uint16_t handle, uint8_t reason) {
     if (btm_cb.acl_disc_reason != HCI_ERR_HOST_REJECT_SECURITY)
       btm_cb.acl_disc_reason = reason;
 
-    p_lcb->disc_reason = btm_cb.acl_disc_reason;
+    p_lcb->disc_reason = reason;
 
     /* Just in case app decides to try again in the callback context */
     p_lcb->link_state = LST_DISCONNECTING;