Merge cherrypicks of [3614756, 3614757, 3614861, 3614758, 3614759, 3615200, 3615201, 3615202, 3615203, 3615204, 3614670, 3614671, 3615108, 3615109] into oc-mr1-releaseandroid-wear-8.1.0_r1android-8.1.0_r19oreo-mr1-wear-releaseoreo-mr1-releaseoreo-mr1-cuttlefish-testing

Change-Id: Ia5da8d2f00425b1f21c3afcff6eefbed68c12346

3 files changed, 45 insertions, 8 deletions

diff --git a/osi/src/config.cc b/osi/src/config.cc
index 10197210b..fc64d4746 100644
--- a/osi/src/config.cc
+++ b/osi/src/config.cc
@@ -34,6 +34,7 @@
 #include "osi/include/allocator.h"
 #include "osi/include/list.h"
 #include "osi/include/log.h"
+#include "log/log.h"
 
 typedef struct {
   char* key;
@@ -217,17 +218,27 @@ void config_set_string(config_t* config, const char* section, const char* key,
     list_append(config->sections, sec);
   }
 
+  std::string value_string = value;
+  std::string value_no_newline;
+  size_t newline_position = value_string.find("\n");
+  if (newline_position != std::string::npos) {
+    android_errorWriteLog(0x534e4554, "70808273");
+    value_no_newline = value_string.substr(0, newline_position);
+  } else {
+    value_no_newline = value_string;
+  }
+
   for (const list_node_t* node = list_begin(sec->entries);
        node != list_end(sec->entries); node = list_next(node)) {
     entry_t* entry = static_cast<entry_t*>(list_node(node));
     if (!strcmp(entry->key, key)) {
       osi_free(entry->value);
-      entry->value = osi_strdup(value);
+      entry->value = osi_strdup(value_no_newline.c_str());
       return;
     }
   }
 
-  entry_t* entry = entry_new(key, value);
+  entry_t* entry = entry_new(key, value_no_newline.c_str());
   list_append(sec->entries, entry);
 }
 
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 144c7786c..334362449 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -22,6 +22,7 @@
 #include "avrc_int.h"
 #include "bt_common.h"
 #include "bt_utils.h"
+#include "log/log.h"
 #include "osi/include/osi.h"
 
 /*****************************************************************************
@@ -459,6 +460,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
       BE_STREAM_TO_UINT8(p_result->list_app_attr.num_attr, p);
       AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,
                        p_result->list_app_attr.num_attr);
+
+      if (p_result->list_app_attr.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
+        android_errorWriteLog(0x534e4554, "63146237");
+        p_result->list_app_attr.num_attr = AVRC_MAX_APP_ATTR_SIZE;
+      }
+
       for (int xx = 0; xx < p_result->list_app_attr.num_attr; xx++) {
         BE_STREAM_TO_UINT8(p_result->list_app_attr.attrs[xx], p);
       }
@@ -487,6 +494,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
           p_result->get_cur_app_val.num_val * sizeof(tAVRC_APP_SETTING));
       AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,
                        p_result->get_cur_app_val.num_val);
+
+      if (p_result->get_cur_app_val.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+        android_errorWriteLog(0x534e4554, "63146237");
+        p_result->get_cur_app_val.num_val = AVRC_MAX_APP_ATTR_SIZE;
+      }
+
       for (int xx = 0; xx < p_result->get_cur_app_val.num_val; xx++) {
         BE_STREAM_TO_UINT8(app_sett[xx].attr_id, p);
         BE_STREAM_TO_UINT8(app_sett[xx].attr_val, p);
@@ -495,7 +508,6 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
     } break;
 
     case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT: {
-      tAVRC_APP_SETTING_TEXT* p_setting_text;
       uint8_t num_attrs;
 
       if (len == 0) {
@@ -503,10 +515,14 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
         break;
       }
       BE_STREAM_TO_UINT8(num_attrs, p);
+      if (num_attrs > AVRC_MAX_APP_ATTR_SIZE) {
+        num_attrs = AVRC_MAX_APP_ATTR_SIZE;
+      }
       AVRC_TRACE_DEBUG("%s attr count = %d ", __func__,
                        p_result->get_app_attr_txt.num_attr);
       p_result->get_app_attr_txt.num_attr = num_attrs;
-      p_setting_text = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
+
+      p_result->get_app_attr_txt.p_attrs = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
           num_attrs * sizeof(tAVRC_APP_SETTING_TEXT));
       for (int xx = 0; xx < num_attrs; xx++) {
         BE_STREAM_TO_UINT8(p_result->get_app_attr_txt.p_attrs[xx].attr_id, p);
@@ -526,7 +542,6 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
     } break;
 
     case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT: {
-      tAVRC_APP_SETTING_TEXT* p_setting_text;
       uint8_t num_vals;
 
       if (len == 0) {
@@ -534,11 +549,14 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(tAVRC_MSG_VENDOR* p_msg,
         break;
       }
       BE_STREAM_TO_UINT8(num_vals, p);
+      if (num_vals > AVRC_MAX_APP_ATTR_SIZE) {
+        num_vals = AVRC_MAX_APP_ATTR_SIZE;
+      }
       p_result->get_app_val_txt.num_attr = num_vals;
       AVRC_TRACE_DEBUG("%s value count = %d ", __func__,
                        p_result->get_app_val_txt.num_attr);
 
-      p_setting_text = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
+      p_result->get_app_val_txt.p_attrs = (tAVRC_APP_SETTING_TEXT*)osi_malloc(
           num_vals * sizeof(tAVRC_APP_SETTING_TEXT));
       for (int i = 0; i < num_vals; i++) {
         BE_STREAM_TO_UINT8(p_result->get_app_val_txt.p_attrs[i].attr_id, p);
diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index 1ed6963a8..12b759897 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -220,6 +220,11 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg,
               p_result->get_app_val_txt.num_val)
             status = AVRC_STS_INTERNAL_ERR;
           else {
+            if (p_result->get_app_val_txt.num_val > AVRC_MAX_APP_ATTR_SIZE) {
+              android_errorWriteLog(0x534e4554, "63146237");
+              p_result->get_app_val_txt.num_val = AVRC_MAX_APP_ATTR_SIZE;
+            }
+
             p_u8 = p_result->get_app_val_txt.vals;
             for (xx = 0; xx < p_result->get_app_val_txt.num_val; xx++) {
               p_u8[xx] = *p++;
@@ -492,8 +497,11 @@ static tAVRC_STS avrc_pars_browsing_cmd(tAVRC_MSG_BROWSE* p_msg,
       BE_STREAM_TO_UINT16(p_result->search.string.str_len, p);
       p_result->search.string.p_str = p_buf;
       if (p_buf) {
-        if (buf_len > p_result->search.string.str_len)
-          buf_len = p_result->search.string.str_len;
+        if (p_result->search.string.str_len > buf_len) {
+          p_result->search.string.str_len = buf_len;
+        } else {
+          android_errorWriteLog(0x534e4554, "63146237");
+        }
         BE_STREAM_TO_ARRAY(p, p_buf, p_result->search.string.str_len);
       } else {
         status = AVRC_STS_INTERNAL_ERR;