Snap for 8173925 from 09f3e013ae9aacb8a7c09b19646aa85160410b02 to mainline-extservices-releaseandroid-mainline-12.0.0_r87android12-mainline-extservices-release

Change-Id: I4e7fef394cd8416f9815e94b6a5217bbbeaf8901

4 files changed, 34 insertions, 0 deletions

diff --git a/Android.bp b/Android.bp
index 2b4938061..b0696503f 100644
--- a/Android.bp
+++ b/Android.bp
@@ -66,3 +66,15 @@ filegroup {
         "AndroidTestTemplate.xml",
     ],
 }
+
+filegroup {
+    name: "framework-bluetooth-srcs",
+    srcs: [],
+    visibility: ["//visibility:private"]
+}
+
+java_library {
+    name: "framework-bluetooth",
+    srcs: [":framework-bluetooth-srcs"],
+    sdk_version: "module_current"
+}
diff --git a/apex/Android.bp b/apex/Android.bp
index c206dca68..676623af6 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -35,3 +35,12 @@ android_app_certificate {
     name: "com.android.bluetooth.updatable.certificate",
     certificate: "com.android.bluetooth.updatable",
 }
+
+// Empty, disabled APEX to allow other libraries to specify "apex_available"
+// in all branches without merge conflicts.
+apex {
+    name: "com.android.bluetooth",
+    enabled: false,
+    key: "com.android.bluetooth.updatable.key",
+    certificate: ":com.android.bluetooth.updatable.certificate",
+}
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 2141bf179..0555af06f 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -581,6 +581,10 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
                        p_result->get_caps.capability_id,
                        p_result->get_caps.count);
       if (p_result->get_caps.capability_id == AVRC_CAP_COMPANY_ID) {
+        if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_COMP_ID) {
+          android_errorWriteLog(0x534e4554, "205837191");
+          return AVRC_STS_INTERNAL_ERR;
+        }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_COMP_ID) * 3;
         if (len < min_len) goto length_error;
         for (int xx = 0; ((xx < p_result->get_caps.count) &&
@@ -590,6 +594,10 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
         }
       } else if (p_result->get_caps.capability_id ==
                  AVRC_CAP_EVENTS_SUPPORTED) {
+        if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_EVT_ID) {
+          android_errorWriteLog(0x534e4554, "205837191");
+          return AVRC_STS_INTERNAL_ERR;
+        }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_EVT_ID);
         if (len < min_len) goto length_error;
         for (int xx = 0; ((xx < p_result->get_caps.count) &&
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index b826dc19c..16454a5b0 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -811,6 +811,11 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
 
     case L2CAP_CMD_CREDIT_BASED_RECONFIG_RES: {
       uint16_t result;
+      if (p + sizeof(uint16_t) > p_pkt_end) {
+        android_errorWriteLog(0x534e4554, "212694559");
+        LOG(ERROR) << "invalid read";
+        return;
+      }
       STREAM_TO_UINT16(result, p);
 
       L2CAP_TRACE_DEBUG(