diff options
author | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2024-01-08 08:32:11 +0000 |
---|---|---|
committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2024-01-08 08:32:11 +0000 |
commit | 5766fd0f2e804bba96f3425f7efd7119415968a8 (patch) | |
tree | 58d432f111cfc92d811ef0f8a5e71de17477ab76 | |
parent | a27b1e78f87d6b79f7eed61cf0e21d14dfd7aebc (diff) | |
parent | efd00e908f90334c71da43dcf83f3a868801bfc5 (diff) | |
download | bt-android11-platform-release.tar.gz |
Merge cherrypicks of ['googleplex-android-review.googlesource.com/25619443'] into rvc-platform-release.android-platform-11.0.0_r40android-platform-11.0.0_r39android11-platform-release
Change-Id: Id222f47d5b46d9f739eb4ad340ca9efe62823cd8
-rw-r--r-- | stack/gatt/att_protocol.cc | 54 |
1 files changed, 11 insertions, 43 deletions
diff --git a/stack/gatt/att_protocol.cc b/stack/gatt/att_protocol.cc index ad1da9495..cdf472e40 100644 --- a/stack/gatt/att_protocol.cc +++ b/stack/gatt/att_protocol.cc @@ -278,78 +278,46 @@ BT_HDR* attp_build_opcode_cmd(uint8_t op_code) { BT_HDR* attp_build_value_cmd(uint16_t payload_size, uint8_t op_code, uint16_t handle, uint16_t offset, uint16_t len, uint8_t* p_data) { - uint8_t *p, *pp, *p_pair_len; - size_t pair_len; - size_t size_now = 1; - - #define CHECK_SIZE() do { \ - if (size_now > payload_size) { \ - LOG(ERROR) << "payload size too small"; \ - osi_free(p_buf); \ - return nullptr; \ - } \ - } while (false) - + uint8_t *p, *pp, pair_len, *p_pair_len; BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET); p = pp = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; - - CHECK_SIZE(); UINT8_TO_STREAM(p, op_code); p_buf->offset = L2CAP_MIN_OFFSET; + p_buf->len = 1; if (op_code == GATT_RSP_READ_BY_TYPE) { p_pair_len = p; pair_len = len + 2; - size_now += 1; - CHECK_SIZE(); - // this field will be backfilled in the end of this function + UINT8_TO_STREAM(p, pair_len); + p_buf->len += 1; } if (op_code != GATT_RSP_READ_BLOB && op_code != GATT_RSP_READ) { - size_now += 2; - CHECK_SIZE(); UINT16_TO_STREAM(p, handle); + p_buf->len += 2; } if (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_RSP_PREPARE_WRITE) { - size_now += 2; - CHECK_SIZE(); UINT16_TO_STREAM(p, offset); + p_buf->len += 2; } - if (len > 0 && p_data != NULL && payload_size > size_now) { + if (len > 0 && p_data != NULL) { /* ensure data not exceed MTU size */ - if (payload_size - size_now < len) { - len = payload_size - size_now; + if (payload_size - p_buf->len < len) { + len = payload_size - p_buf->len; /* update handle value pair length */ - if (op_code == GATT_RSP_READ_BY_TYPE) { - pair_len = (len + 2); - } + if (op_code == GATT_RSP_READ_BY_TYPE) *p_pair_len = (len + 2); LOG(WARNING) << StringPrintf( "attribute value too long, to be truncated to %d", len); } - size_now += len; - CHECK_SIZE(); ARRAY_TO_STREAM(p, p_data, len); + p_buf->len += len; } - // backfill pair len field - if (op_code == GATT_RSP_READ_BY_TYPE) { - if (pair_len > UINT8_MAX) { - LOG(ERROR) << "pair_len greater than" << UINT8_MAX; - osi_free(p_buf); - return nullptr; - } - - *p_pair_len = (uint8_t) pair_len; - } - - #undef CHECK_SIZE - - p_buf->len = (uint16_t) size_now; return p_buf; } |