diff options
Diffstat (limited to 'bta/pan/bta_pan_act.cc')
| -rw-r--r-- | bta/pan/bta_pan_act.cc | 34 |
1 files changed, 14 insertions, 20 deletions
diff --git a/bta/pan/bta_pan_act.cc b/bta/pan/bta_pan_act.cc index 41e0bf6b4..789cce8e3 100644 --- a/bta/pan/bta_pan_act.cc +++ b/bta/pan/bta_pan_act.cc @@ -171,31 +171,25 @@ static void bta_pan_data_flow_cb(uint16_t handle, tPAN_RESULT result) { static void bta_pan_data_buf_ind_cback(uint16_t handle, const RawAddress& src, const RawAddress& dst, uint16_t protocol, BT_HDR* p_buf, bool ext, bool forward) { - tBTA_PAN_SCB* p_scb; - BT_HDR* p_new_buf; - - p_scb = bta_pan_scb_by_handle(handle); + tBTA_PAN_SCB* p_scb = bta_pan_scb_by_handle(handle); if (p_scb == NULL) { return; } - if (sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset) { - /* offset smaller than data structure in front of actual data */ - if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len > - PAN_BUF_SIZE) { - android_errorWriteLog(0x534e4554, "63146237"); - APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__, - p_buf->len); - return; - } - p_new_buf = (BT_HDR*)osi_malloc(PAN_BUF_SIZE); - memcpy((uint8_t*)(p_new_buf + 1) + sizeof(tBTA_PAN_DATA_PARAMS), - (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len); - p_new_buf->len = p_buf->len; - p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS); - } else { - p_new_buf = p_buf; + if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len > + PAN_BUF_SIZE) { + android_errorWriteLog(0x534e4554, "63146237"); + APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__, + p_buf->len); + return; } + + BT_HDR* p_new_buf = (BT_HDR*)osi_malloc(PAN_BUF_SIZE); + memcpy((uint8_t*)(p_new_buf + 1) + sizeof(tBTA_PAN_DATA_PARAMS), + (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len); + p_new_buf->len = p_buf->len; + p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS); + /* copy params into the space before the data */ ((tBTA_PAN_DATA_PARAMS*)p_new_buf)->src = src; ((tBTA_PAN_DATA_PARAMS*)p_new_buf)->dst = dst; |