Snap for 7217438 from 4352c363de9fd8a963382204620ec72947eb51dc to rvc-platform-release am: 3f59d603b5

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/13956613

Change-Id: I9f7ba88d8c23449ea176f7c54c264afd101c8c6f

6 files changed, 21 insertions, 14 deletions

diff --git a/stack/avrc/avrc_api.cc b/stack/avrc/avrc_api.cc
index 62b7fe478..1ac856a2f 100644
--- a/stack/avrc/avrc_api.cc
+++ b/stack/avrc/avrc_api.cc
@@ -237,7 +237,7 @@ static uint8_t* avrc_get_data_ptr(BT_HDR* p_pkt) {
 static BT_HDR* avrc_copy_packet(BT_HDR* p_pkt, int rsp_pkt_len) {
   const int offset = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
   const int pkt_len = MAX(rsp_pkt_len, p_pkt->len);
-  BT_HDR* p_pkt_copy = (BT_HDR*)osi_malloc(BT_HDR_SIZE + offset + pkt_len);
+  BT_HDR* p_pkt_copy = (BT_HDR*)osi_calloc(BT_HDR_SIZE + offset + pkt_len);
 
   /* Copy the packet header, set the new offset, and copy the payload */
   memcpy(p_pkt_copy, p_pkt, BT_HDR_SIZE);
@@ -316,7 +316,7 @@ static uint16_t avrc_send_continue_frag(uint8_t handle, uint8_t label) {
   if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {
     int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
     p_pkt_old = p_fcb->p_fmsg;
-    p_pkt = (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
+    p_pkt = (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
     p_pkt->len = AVRC_MAX_CTRL_DATA_LEN;
     p_pkt->offset = AVCT_MSG_OFFSET;
     p_pkt->layer_specific = p_pkt_old->layer_specific;
@@ -426,7 +426,7 @@ static BT_HDR* avrc_proc_vendor_command(uint8_t handle, uint8_t label,
   }
 
   if (status != AVRC_STS_NO_ERROR) {
-    p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+    p_rsp = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
     p_rsp->offset = p_pkt->offset;
     p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset;
     *p_data++ = AVRC_RSP_REJ;
@@ -487,7 +487,7 @@ static uint8_t avrc_proc_far_msg(uint8_t handle, uint8_t label, uint8_t cr,
     if (pkt_type == AVRC_PKT_START) {
       /* Allocate buffer for re-assembly */
       p_rcb->rasm_pdu = *p_data;
-      p_rcb->p_rmsg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+      p_rcb->p_rmsg = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
       /* Copy START packet to buffer for re-assembling fragments */
       memcpy(p_rcb->p_rmsg, p_pkt, sizeof(BT_HDR)); /* Copy bt hdr */
 
@@ -922,7 +922,7 @@ static BT_HDR* avrc_pass_msg(tAVRC_MSG_PASS* p_msg) {
   CHECK(p_msg != NULL);
   CHECK(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->pass_len));
 
-  BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+  BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
   p_cmd->offset = AVCT_MSG_OFFSET;
   p_cmd->layer_specific = AVCT_DATA_CTRL;
 
@@ -1190,7 +1190,7 @@ uint16_t AVRC_MsgReq(uint8_t handle, uint8_t label, uint8_t ctype,
     if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {
       int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
       BT_HDR* p_pkt_new =
-          (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
+          (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
       if (p_start != NULL) {
         p_fcb->frag_enabled = true;
         p_fcb->p_fmsg = p_pkt;
diff --git a/stack/avrc/avrc_bld_ct.cc b/stack/avrc/avrc_bld_ct.cc
index 384ae6091..4d85d1797 100644
--- a/stack/avrc/avrc_bld_ct.cc
+++ b/stack/avrc/avrc_bld_ct.cc
@@ -536,7 +536,7 @@ static BT_HDR* avrc_bld_init_cmd_buffer(tAVRC_COMMAND* p_cmd) {
   }
 
   /* allocate and initialize the buffer */
-  BT_HDR* p_pkt = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);
+  BT_HDR* p_pkt = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
   uint8_t *p_data, *p_start;
 
   p_pkt->layer_specific = chnl;
diff --git a/stack/avrc/avrc_bld_tg.cc b/stack/avrc/avrc_bld_tg.cc
index 1dac160f0..73da3456e 100644
--- a/stack/avrc/avrc_bld_tg.cc
+++ b/stack/avrc/avrc_bld_tg.cc
@@ -1322,7 +1322,7 @@ static BT_HDR* avrc_bld_init_rsp_buffer(tAVRC_RESPONSE* p_rsp) {
   }
 
   /* allocate and initialize the buffer */
-  BT_HDR* p_pkt = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+  BT_HDR* p_pkt = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
   uint8_t *p_data, *p_start;
 
   p_pkt->layer_specific = chnl;
diff --git a/stack/avrc/avrc_opt.cc b/stack/avrc/avrc_opt.cc
index de42e15f1..a9ad908d3 100644
--- a/stack/avrc/avrc_opt.cc
+++ b/stack/avrc/avrc_opt.cc
@@ -51,7 +51,7 @@ static BT_HDR* avrc_vendor_msg(tAVRC_MSG_VENDOR* p_msg) {
   CHECK(p_msg != NULL);
 
   CHECK(AVRC_META_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->vendor_len));
-  p_cmd = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);
+  p_cmd = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
 
   p_cmd->offset = AVCT_MSG_OFFSET;
   p_data = (uint8_t*)(p_cmd + 1) + p_cmd->offset;
@@ -91,7 +91,7 @@ static BT_HDR* avrc_vendor_msg(tAVRC_MSG_VENDOR* p_msg) {
  *
  *****************************************************************************/
 uint16_t AVRC_UnitCmd(uint8_t handle, uint8_t label) {
-  BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+  BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
   uint8_t* p_data;
 
   p_cmd->offset = AVCT_MSG_OFFSET;
@@ -134,7 +134,7 @@ uint16_t AVRC_UnitCmd(uint8_t handle, uint8_t label) {
  *
  *****************************************************************************/
 uint16_t AVRC_SubCmd(uint8_t handle, uint8_t label, uint8_t page) {
-  BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+  BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
   uint8_t* p_data;
 
   p_cmd->offset = AVCT_MSG_OFFSET;
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 7b64b86e3..7c6367644 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -308,7 +308,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg,
             BE_STREAM_TO_UINT16(player->name.str_len, p);
             min_len += player->name.str_len;
             if (pkt_len < min_len) goto browse_length_error;
-            player->name.p_str = (uint8_t*)osi_malloc(
+            player->name.p_str = (uint8_t*)osi_calloc(
                 (player->name.str_len + 1) * sizeof(uint8_t));
             BE_STREAM_TO_ARRAY(p, player->name.p_str, player->name.str_len);
             AVRC_TRACE_DEBUG(
@@ -336,7 +336,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg,
             BE_STREAM_TO_UINT16(folder->name.str_len, p);
             min_len += folder->name.str_len;
             if (pkt_len < min_len) goto browse_length_error;
-            folder->name.p_str = (uint8_t*)osi_malloc(
+            folder->name.p_str = (uint8_t*)osi_calloc(
                 (folder->name.str_len + 1) * sizeof(uint8_t));
             BE_STREAM_TO_ARRAY(p, folder->name.p_str, folder->name.str_len);
             AVRC_TRACE_DEBUG("%s type %d playable %d cs %d name len %d",
@@ -488,7 +488,7 @@ static tAVRC_STS avrc_pars_browse_rsp(tAVRC_MSG_BROWSE* p_msg,
         AVRC_TRACE_DEBUG("%s AVRC_PDU_SET_BROWSED_PLAYER item: %d len: %d",
                          __func__, i, folder_name->str_len);
         folder_name->p_str =
-            (uint8_t*)osi_malloc((folder_name->str_len + 1) * sizeof(uint8_t));
+            (uint8_t*)osi_calloc((folder_name->str_len + 1) * sizeof(uint8_t));
         BE_STREAM_TO_ARRAY(p, folder_name->p_str, folder_name->str_len);
       }
       break;
diff --git a/stack/btm/btm_sec.cc b/stack/btm/btm_sec.cc
index 5d7d0f93b..bdda174ac 100644
--- a/stack/btm/btm_sec.cc
+++ b/stack/btm/btm_sec.cc
@@ -4674,6 +4674,13 @@ void btm_sec_pin_code_request(const RawAddress& p_bda) {
   VLOG(2) << __func__ << " BDA: " << p_bda
           << " state: " << btm_pair_state_descr(btm_cb.pairing_state);
 
+  RawAddress local_bd_addr = *controller_get_interface()->get_address();
+  if (p_bda == local_bd_addr) {
+    android_errorWriteLog(0x534e4554, "174626251");
+    btsnd_hcic_pin_code_neg_reply(p_bda);
+    return;
+  }
+
   if (btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) {
     if ((p_bda == btm_cb.pairing_bda) &&
         (btm_cb.pairing_state == BTM_PAIR_STATE_WAIT_AUTH_COMPLETE)) {