Merge branch 'bugfix/btdm_hfp_invalid_hci_sync_pkt_len' into 'master'

bugfix/btdm_hfp_invalid_hci_sync_pkt_len

See merge request idf/esp-idf!3186
pull/2386/head
Jiang Jiang Jian 2018-09-06 19:51:42 +08:00
commit affe75a102
2 zmienionych plików z 7 dodań i 7 usunięć

Wyświetl plik

@ -429,7 +429,6 @@ static void bta_hf_client_sco_event(UINT8 event)
if (event == BTA_HF_CLIENT_SCO_CI_DATA_E) {
uint16_t pkt_offset = 1 + HCI_SCO_PREAMBLE_SIZE;
uint16_t len_to_send = 0;
uint8_t *p;
while (true)
{
p_buf = osi_malloc(sizeof(BT_HDR) + pkt_offset + BTM_SCO_DATA_SIZE_MAX);
@ -439,13 +438,13 @@ static void bta_hf_client_sco_event(UINT8 event)
}
p_buf->offset = pkt_offset;
p_buf->len = BTM_SCO_DATA_SIZE_MAX;
len_to_send = bta_hf_client_sco_co_out_data(p_buf->data + pkt_offset, BTM_SCO_DATA_SIZE_MAX);
if (len_to_send) {
if (len_to_send == BTM_SCO_DATA_SIZE_MAX) {
// expect to get the exact size of data from upper layer
if (bta_hf_client_cb.scb.sco_state == BTA_HF_CLIENT_SCO_OPEN_ST) {
p = (UINT8 *)(p_buf->data + pkt_offset -1);
*p = len_to_send; // set SCO packet length;
tBTM_STATUS write_stat = BTM_WriteScoData(p_scb->sco_idx, p_buf);
if (write_stat != BTM_SUCCESS && write_stat != BTM_SCO_BAD_LENGTH) {
if (write_stat != BTM_SUCCESS) {
break;
}
} else {

Wyświetl plik

@ -431,12 +431,13 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
/* only sent the first BTM_SCO_DATA_SIZE_MAX bytes data if more than max,
and set warning status */
if (p_buf->len > BTM_SCO_DATA_SIZE_MAX) {
BTM_TRACE_WARNING ("BTM SCO hdl %x, bad len %u", p_ccb->hci_handle, p_buf->len);
p_buf->len = BTM_SCO_DATA_SIZE_MAX;
status = BTM_SCO_BAD_LENGTH;
}
UINT8_TO_STREAM (p, (UINT8)p_buf->len);
BTM_TRACE_DEBUG ("BTM SCO hdl %x, len %u", p_ccb->hci_handle, p_buf->len);
p_buf->len += HCI_SCO_PREAMBLE_SIZE;
if (fixed_queue_length(p_ccb->xmit_data_q) < BTM_SCO_XMIT_QUEUE_THRS) {
@ -453,7 +454,7 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
status = BTM_UNKNOWN_ADDR;
}
if (status != BTM_SUCCESS && status != BTM_SCO_BAD_LENGTH) {
if (status != BTM_SUCCESS) {
BTM_TRACE_WARNING ("stat %d", status);
osi_free(p_buf);
}