diff options
| author | Wei Wang <weiwa@google.com> | 2014-10-06 19:16:26 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2014-10-06 19:16:27 +0000 |
| commit | de898558badd0d575829c4011fdffd33c548c1d6 (patch) | |
| tree | d8bbe83dd50e1cccfc0ab3c6bdfdfd7ad42ce041 | |
| parent | 19a8f456d4a38694eaec270eabc5ff9aa639c86d (diff) | |
| parent | 21015a484b3fa3d7aa7cdc291b30238089d14f4e (diff) | |
| download | bluedroid-de898558badd0d575829c4011fdffd33c548c1d6.tar.gz | |
Merge "Fix an "array index out of bound" bug for RPA." into lmp-dev
| -rw-r--r-- | stack/btm/btm_ble_gap.c | 6 | ||||
| -rw-r--r-- | stack/btm/btm_ble_multi_adv.c | 6 |
2 files changed, 7 insertions, 5 deletions
diff --git a/stack/btm/btm_ble_gap.c b/stack/btm/btm_ble_gap.c index a51b569..a6f095f 100644 --- a/stack/btm/btm_ble_gap.c +++ b/stack/btm/btm_ble_gap.c @@ -28,8 +28,9 @@ #include "bt_types.h" #include "bt_utils.h" -#include "btu.h" #include "btm_int.h" +#include "btm_ble_api.h" +#include "btu.h" #include "hcimsgs.h" #if (GAP_INCLUDED == TRUE) #include "gap_api.h" @@ -613,7 +614,8 @@ void BTM_BleConfigPrivacy(BOOLEAN enable) *******************************************************************************/ BTM_API extern UINT8 BTM_BleMaxMultiAdvInstanceCount() { - return btm_cb.cmn_ble_vsc_cb.adv_inst_max; + return btm_cb.cmn_ble_vsc_cb.adv_inst_max < BTM_BLE_MULTI_ADV_MAX ? + btm_cb.cmn_ble_vsc_cb.adv_inst_max : BTM_BLE_MULTI_ADV_MAX; } #if BLE_PRIVACY_SPT == TRUE diff --git a/stack/btm/btm_ble_multi_adv.c b/stack/btm/btm_ble_multi_adv.c index b2838a7..6876726 100644 --- a/stack/btm/btm_ble_multi_adv.c +++ b/stack/btm/btm_ble_multi_adv.c @@ -383,7 +383,7 @@ void btm_ble_multi_adv_gen_rpa_cmpl(tBTM_RAND_ENC *p) } else { - btm_multi_adv_idx_q.front = btm_multi_adv_idx_q.front +1 % BTM_BLE_MULTI_ADV_MAX; + btm_multi_adv_idx_q.front = (btm_multi_adv_idx_q.front + 1) % BTM_BLE_MULTI_ADV_MAX; } } @@ -433,7 +433,7 @@ void btm_ble_multi_adv_gen_rpa_cmpl(tBTM_RAND_ENC *p) *******************************************************************************/ void btm_ble_multi_adv_configure_rpa (tBTM_BLE_MULTI_ADV_INST *p_inst) { - if (btm_multi_adv_idx_q.front == btm_multi_adv_idx_q.rear +1 % BTM_BLE_MULTI_ADV_MAX) + if (btm_multi_adv_idx_q.front == (btm_multi_adv_idx_q.rear + 1) % BTM_BLE_MULTI_ADV_MAX) { BTM_TRACE_ERROR("outstanding rand generation exceeded max allowed "); return; @@ -447,7 +447,7 @@ void btm_ble_multi_adv_configure_rpa (tBTM_BLE_MULTI_ADV_INST *p_inst) } else { - btm_multi_adv_idx_q.rear = btm_multi_adv_idx_q.rear +1 % BTM_BLE_MULTI_ADV_MAX; + btm_multi_adv_idx_q.rear = (btm_multi_adv_idx_q.rear + 1) % BTM_BLE_MULTI_ADV_MAX; } btm_multi_adv_idx_q.inst_index_queue[btm_multi_adv_idx_q.rear] = p_inst->index; } |