fix a2dp source crash when connect to Bose speaker

components/bt/host/bluedroid/bta/av/bta_av_aact.c

@@ -1299,11 +1299,11 @@ void bta_av_setconfig_rsp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
 
         if (p_scb->codec_type == BTA_AV_CODEC_SBC || num > 1) {
             /* if SBC is used by the SNK as INT, discover req is not sent in bta_av_config_ind.
-                       * call disc_res now */
+                       * call cfg_res now */
             /* this is called in A2DP SRC path only, In case of SINK we don't need it  */
             if (local_sep == AVDT_TSEP_SRC) {
-                p_scb->p_cos->disc_res(p_scb->hndl, num, num, 0, p_scb->peer_addr,
-                                       UUID_SERVCLASS_AUDIO_SOURCE);
+                p_scb->p_cos->cfg_res(p_scb->hndl, num, num, 0, p_scb->peer_addr,
+                                      UUID_SERVCLASS_AUDIO_SOURCE);
             }
         } else {
             /* we do not know the peer device and it is using non-SBC codec

components/bt/host/bluedroid/bta/include/bta/bta_av_api.h

@@ -262,6 +262,8 @@ typedef BOOLEAN (*tBTA_AV_CO_INIT) (UINT8 *p_codec_type, UINT8 *p_codec_info,
                                     UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 tsep);
 typedef void (*tBTA_AV_CO_DISC_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
                                      UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
+typedef void (*tBTA_AV_CO_CFG_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
+                                     UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
 typedef UINT8 (*tBTA_AV_CO_GETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
                                     UINT8 *p_codec_info, UINT8 *p_sep_info_idx, UINT8 seid,
                                     UINT8 *p_num_protect, UINT8 *p_protect_info);
@@ -291,6 +293,7 @@ typedef BOOLEAN (*tBTA_AVRC_CO_RN_EVT_SUPPORTED) (UINT8 event_id);
 typedef struct {
     tBTA_AV_CO_INIT               init;
     tBTA_AV_CO_DISC_RES           disc_res;
+    tBTA_AV_CO_CFG_RES            cfg_res;
     tBTA_AV_CO_GETCFG             getcfg;
     tBTA_AV_CO_SETCFG             setcfg;
     tBTA_AV_CO_OPEN               open;

components/bt/host/bluedroid/btc/profile/std/a2dp/bta_av_co.c

@@ -312,6 +312,58 @@ void bta_av_co_audio_disc_res(tBTA_AV_HNDL hndl, UINT8 num_seps, UINT8 num_snk,
     } else if (uuid_local == UUID_SERVCLASS_AUDIO_SOURCE) {
         p_peer->uuid_to_connect = UUID_SERVCLASS_AUDIO_SINK;
     }
+    p_peer->got_disc_res = TRUE;
+}
+
+/*******************************************************************************
+ **
+ ** Function         bta_av_co_audio_cfg_res
+ **
+ ** Description      This callout function is executed by AV to report the
+ **                  number of stream end points (SEP) were found during the
+ **                  incoming AVDT stream config request process.
+ **
+ **
+ ** Returns          void.
+ **
+ *******************************************************************************/
+void bta_av_co_audio_cfg_res(tBTA_AV_HNDL hndl, UINT8 num_seps, UINT8 num_snk,
+                              UINT8 num_src, BD_ADDR addr, UINT16 uuid_local)
+{
+    tBTA_AV_CO_PEER *p_peer;
+
+    FUNC_TRACE();
+
+    APPL_TRACE_DEBUG("bta_av_co_audio_cfg_res h:x%x num_seps:%d num_snk:%d num_src:%d",
+                     hndl, num_seps, num_snk, num_src);
+
+    /* Find the peer info */
+    p_peer = bta_av_co_get_peer(hndl);
+    if (p_peer == NULL) {
+        APPL_TRACE_ERROR("bta_av_co_audio_cfg_res could not find peer entry");
+        return;
+    }
+
+    /* Sanity check : this should never happen */
+    if (p_peer->opened) {
+        APPL_TRACE_ERROR("bta_av_co_audio_cfg_res peer already opened");
+    }
+
+    /* Copy the discovery results */
+    bdcpy(p_peer->addr, addr);
+    if (!p_peer->got_disc_res) {
+        p_peer->num_snks = num_snk;
+        p_peer->num_srcs = num_src;
+        p_peer->num_seps = num_seps;
+        p_peer->num_rx_snks = 0;
+        p_peer->num_rx_srcs = 0;
+        p_peer->num_sup_snks = 0;
+    }
+    if (uuid_local == UUID_SERVCLASS_AUDIO_SINK) {
+        p_peer->uuid_to_connect = UUID_SERVCLASS_AUDIO_SOURCE;
+    } else if (uuid_local == UUID_SERVCLASS_AUDIO_SOURCE) {
+        p_peer->uuid_to_connect = UUID_SERVCLASS_AUDIO_SINK;
+    }
 }
 
 /*******************************************************************************
@@ -1698,6 +1750,7 @@ BOOLEAN bta_av_co_get_remote_bitpool_pref(UINT8 *min, UINT8 *max)
 const tBTA_AV_CO_FUNCTS bta_av_a2d_cos = {
     bta_av_co_audio_init,
     bta_av_co_audio_disc_res,
+    bta_av_co_audio_cfg_res,
     bta_av_co_audio_getconfig,
     bta_av_co_audio_setconfig,
     bta_av_co_audio_open,

components/bt/host/bluedroid/btc/profile/std/a2dp/include/btc_av_co.h

@@ -53,6 +53,7 @@ typedef struct {
     BOOLEAN         opened;             /* opened */
     UINT16          mtu;                /* maximum transmit unit size */
     UINT16          uuid_to_connect;    /* uuid of peer device */
+    BOOLEAN         got_disc_res;       /* got the results of initiating discovery */
 } tBTA_AV_CO_PEER;
 
 typedef struct {