• R/O
  • HTTP
  • SSH
  • HTTPS

コミット

タグ
未設定

よく使われているワード(クリックで追加)

javac++androidlinuxc#windowsobjective-ccocoa誰得qtpythonphprubygameguibathyscaphec計画中(planning stage)翻訳omegatframeworktwitterdomtestvb.netdirectxゲームエンジンbtronarduinopreviewer

system/bt


コミットメタ情報

リビジョン6562ba76661ef9099fabda00830fe055296fa8c6 (tree)
日時2018-11-13 03:10:55
作者Marie Janssen <jamuraa@goog...>
コミッターKevin Haggerty

ログメッセージ

AVRCP: unify Get{Element,Item}Attributes response.

GetElementAttributes response and GetItemAttributes response share the
same format and require the same checks for length.

Test: play media on carkit, see media. especially with long items.
Bug: 32407250
Bug: 30571638
Change-Id: I8623e7d662f7a39112b7527b6f5ab63c5e32379c

変更サマリ

差分

--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -352,7 +352,7 @@ static void handle_app_cur_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_
352352 static void handle_app_attr_txt_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_APP_ATTR_TXT_RSP *p_rsp);
353353 static void handle_app_attr_val_txt_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_APP_ATTR_TXT_RSP *p_rsp);
354354 static void handle_get_playstatus_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_PLAY_STATUS_RSP *p_rsp);
355-static void handle_get_elem_attr_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_ELEM_ATTRS_RSP *p_rsp);
355+static void handle_get_elem_attr_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_ATTRS_RSP* p_rsp);
356356 static void handle_set_app_attr_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_RSP *p_rsp);
357357 static bt_status_t get_play_status_cmd(void);
358358 static bt_status_t get_player_app_setting_value_text_cmd (UINT8 *vals, UINT8 num_vals);
@@ -3131,10 +3131,10 @@ static bt_status_t get_element_attr_rsp(uint8_t num_attr, btrc_element_attr_val_
31313131 }
31323132 avrc_rsp.get_play_status.status = AVRC_STS_NO_ERROR;
31333133 }
3134- avrc_rsp.get_elem_attrs.num_attr = num_attr;
3135- avrc_rsp.get_elem_attrs.p_attrs = element_attrs;
3136- avrc_rsp.get_elem_attrs.pdu = AVRC_PDU_GET_ELEMENT_ATTR;
3137- avrc_rsp.get_elem_attrs.opcode = opcode_from_pdu(AVRC_PDU_GET_ELEMENT_ATTR);
3134+ avrc_rsp.get_attrs.num_attrs = num_attr;
3135+ avrc_rsp.get_attrs.p_attrs = element_attrs;
3136+ avrc_rsp.get_attrs.pdu = AVRC_PDU_GET_ELEMENT_ATTR;
3137+ avrc_rsp.get_attrs.opcode = opcode_from_pdu(AVRC_PDU_GET_ELEMENT_ATTR);
31383138 /* Send the response */
31393139 SEND_METAMSG_RSP(IDX_GET_ELEMENT_ATTR_RSP, &avrc_rsp, rc_index);
31403140 return BT_STATUS_SUCCESS;
@@ -3597,8 +3597,8 @@ static bt_status_t get_itemattr_rsp(uint8_t num_attr, btrc_element_attr_val_t *p
35973597 }
35983598 avrc_rsp.get_attrs.status = AVRC_STS_NO_ERROR;
35993599 }
3600- avrc_rsp.get_attrs.attr_count = num_attr;
3601- avrc_rsp.get_attrs.p_attr_list = element_attrs;
3600+ avrc_rsp.get_attrs.num_attrs = num_attr;
3601+ avrc_rsp.get_attrs.p_attrs = element_attrs;
36023602 avrc_rsp.get_attrs.pdu = AVRC_PDU_GET_ITEM_ATTRIBUTES;
36033603 avrc_rsp.get_attrs.opcode = opcode_from_pdu(AVRC_PDU_GET_ITEM_ATTRIBUTES);
36043604 /* Send the response */
@@ -4036,8 +4036,8 @@ static void btif_rc_status_cmd_timeout_handler(UNUSED_ATTR uint16_t event,
40364036 break;
40374037
40384038 case AVRC_PDU_GET_ELEMENT_ATTR:
4039- avrc_response.get_elem_attrs.status = BTIF_RC_STS_TIMEOUT;
4040- handle_get_elem_attr_response(&meta_msg, &avrc_response.get_elem_attrs);
4039+ avrc_response.get_attrs.status = BTIF_RC_STS_TIMEOUT;
4040+ handle_get_elem_attr_response(&meta_msg, &avrc_response.get_attrs);
40414041 break;
40424042
40434043 case AVRC_PDU_GET_PLAY_STATUS:
@@ -4974,17 +4974,17 @@ static void handle_set_app_attr_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC
49744974 **
49754975 ***************************************************************************/
49764976 static void handle_get_elem_attr_response (tBTA_AV_META_MSG *pmeta_msg,
4977- tAVRC_GET_ELEM_ATTRS_RSP *p_rsp)
4977+ tAVRC_GET_ATTRS_RSP* p_rsp)
49784978 {
49794979 if (p_rsp->status == AVRC_STS_NO_ERROR) {
49804980 bt_bdaddr_t rc_addr;
4981- size_t buf_size = p_rsp->num_attr * sizeof(btrc_element_attr_val_t);
4981+ size_t buf_size = p_rsp->num_attrs * sizeof(btrc_element_attr_val_t);
49824982 btrc_element_attr_val_t *p_attr =
49834983 (btrc_element_attr_val_t *)osi_calloc(buf_size);
49844984
49854985 bdcpy(rc_addr.address, btif_rc_cb[0].rc_addr);
49864986
4987- for (int i = 0; i < p_rsp->num_attr; i++) {
4987+ for (int i = 0; i < p_rsp->num_attrs; i++) {
49884988 p_attr[i].attr_id = p_rsp->p_attrs[i].attr_id;
49894989 /* Todo. Legth limit check to include null */
49904990 if (p_rsp->p_attrs[i].name.str_len &&
@@ -4995,7 +4995,7 @@ static void handle_get_elem_attr_response (tBTA_AV_META_MSG *pmeta_msg,
49954995 }
49964996 }
49974997 HAL_CBACK(bt_rc_ctrl_callbacks, track_changed_cb,
4998- &rc_addr, p_rsp->num_attr, p_attr);
4998+ &rc_addr, p_rsp->num_attrs, p_attr);
49994999 osi_free(p_attr);
50005000 } else if (p_rsp->status == BTIF_RC_STS_TIMEOUT) {
50015001 /* Retry for timeout case, this covers error handling
@@ -5138,7 +5138,7 @@ static void handle_avk_rc_metamsg_rsp(tBTA_AV_META_MSG *pmeta_msg)
51385138 break;
51395139
51405140 case AVRC_PDU_GET_ELEMENT_ATTR:
5141- handle_get_elem_attr_response(pmeta_msg, &avrc_response.get_elem_attrs);
5141+ handle_get_elem_attr_response(pmeta_msg, &avrc_response.get_attrs);
51425142 break;
51435143
51445144 case AVRC_PDU_GET_PLAY_STATUS:
--- a/stack/avrc/avrc_bld_tg.c
+++ b/stack/avrc/avrc_bld_tg.c
@@ -445,71 +445,6 @@ static tAVRC_STS avrc_bld_inform_battery_status_rsp (tAVRC_RSP *p_rsp, BT_HDR *p
445445
446446 /*******************************************************************************
447447 **
448-** Function avrc_bld_get_elem_attrs_rsp
449-**
450-** Description This function builds the Get Element Attributes
451-** response.
452-**
453-** Returns AVRC_STS_NO_ERROR, if the response is built successfully
454-** Otherwise, the error code.
455-**
456-*******************************************************************************/
457-static tAVRC_STS avrc_bld_get_elem_attrs_rsp (tAVRC_GET_ELEM_ATTRS_RSP *p_rsp, BT_HDR *p_pkt)
458-{
459- UINT8 *p_data, *p_start, *p_len, *p_count;
460- UINT16 len;
461- UINT8 xx;
462-
463- AVRC_TRACE_API("%s", __func__);
464- if (!p_rsp->p_attrs)
465- {
466- AVRC_TRACE_ERROR("%s NULL parameter", __func__);
467- return AVRC_STS_BAD_PARAM;
468- }
469-
470- /* get the existing length, if any, and also the num attributes */
471- p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
472- p_data = p_len = p_start + 2; /* pdu + rsvd */
473-
474- BE_STREAM_TO_UINT16(len, p_data);
475- p_count = p_data;
476-
477- if (len == 0)
478- {
479- *p_count = 0;
480- p_data++;
481- }
482- else
483- {
484- p_data = p_start + p_pkt->len;
485- }
486-
487- for (xx=0; xx<p_rsp->num_attr; xx++)
488- {
489- if (!AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_rsp->p_attrs[xx].attr_id))
490- {
491- AVRC_TRACE_ERROR("%s invalid attr id[%d]: %d",
492- __func__, xx, p_rsp->p_attrs[xx].attr_id);
493- continue;
494- }
495- if ( !p_rsp->p_attrs[xx].name.p_str )
496- {
497- p_rsp->p_attrs[xx].name.str_len = 0;
498- }
499- UINT32_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].attr_id);
500- UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.charset_id);
501- UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.str_len);
502- ARRAY_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.p_str, p_rsp->p_attrs[xx].name.str_len);
503- (*p_count)++;
504- }
505- len = p_data - p_count;
506- UINT16_TO_BE_STREAM(p_len, len);
507- p_pkt->len = (p_data - p_start);
508- return AVRC_STS_NO_ERROR;
509-}
510-
511-/*******************************************************************************
512-**
513448 ** Function avrc_bld_get_play_status_rsp
514449 **
515450 ** Description This function builds the Get Play Status
@@ -982,56 +917,97 @@ static tAVRC_STS avrc_bld_set_browse_player_rsp (tAVRC_SET_BR_PLAYER_RSP *p_rsp,
982917
983918 /*******************************************************************************
984919 **
985-** Function avrc_bld_get_item_attrs_rsp
920+** Function avrc_bld_get_attrs_rsp
986921 **
987-** Description This function builds the Get Item Attributes
988-** response.
922+** Description This function builds the Get Item Attributes or
923+** Get Element Attributes response,
924+**
925+** The Get Item Attributes message goes through the
926+** Browsing channel (already specified in the |p_pkt|)
989927 **
990928 ** Returns AVRC_STS_NO_ERROR, if the response is built successfully
929+** AVRC_STS_INTERNAL_ERR, if the given buffer does not have enough room
991930 ** Otherwise, the error code.
992931 **
993932 *******************************************************************************/
994-static tAVRC_STS avrc_bld_get_item_attrs_rsp (tAVRC_GET_ATTRS_RSP *p_rsp, BT_HDR *p_pkt)
933+static tAVRC_STS avrc_bld_get_attrs_rsp (tAVRC_GET_ATTRS_RSP *p_rsp, BT_HDR *p_pkt)
995934 {
996- UINT8 *p_data, *p_start;
997- UINT16 param_len;
998- UINT8 xx;
999-
1000- AVRC_TRACE_API("avrc_bld_get_item_attrs_rsp");
1001- if (!p_rsp->p_attr_list)
935+ uint8_t *p_data, *p_start;
936+ uint8_t *p_len;
937+ uint16_t len_left;
938+ uint8_t *p_num;
939+ uint16_t mtu;
940+ AVRC_TRACE_API("%s", __func__);
941+ /* calculate the buffer size needed and validate the parameters */
942+ if (!p_rsp || !p_rsp->p_attrs)
1002943 {
1003- AVRC_TRACE_ERROR("avrc_bld_get_item_attrs_rsp NULL parameter");
944+ AVRC_TRACE_ERROR("NULL p_attrs");
1004945 return AVRC_STS_BAD_PARAM;
1005946 }
1006-
947+ /* check the length before adding the attr to the message */
948+ uint16_t len = 2;
949+ for (uint8_t xx = 0; xx < p_rsp->num_attrs; xx++)
950+ {
951+ if(p_rsp->p_attrs[xx].name.p_str == 0 ||
952+ !AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_rsp->p_attrs[xx].attr_id))
953+ {
954+ AVRC_TRACE_ERROR("[%d] NULL p_attrs str or bad attr_id:%d", xx,
955+ p_rsp->p_attrs[xx].attr_id);
956+ return AVRC_STS_BAD_PARAM;
957+ }
958+ len += (p_rsp->p_attrs[xx].name.str_len + 8);
959+ }
960+ len_left = BT_DEFAULT_BUFFER_SIZE - BT_HDR_SIZE;
961+ p_data = (uint8_t *)(p_pkt + 1);
962+ BE_STREAM_TO_UINT16 (mtu, p_data);
963+ if (len_left > mtu)
964+ {
965+ len_left = mtu;
966+ }
967+ len_left = len_left - p_pkt->offset - p_pkt->len;
968+ AVRC_TRACE_DEBUG("len_left:%d, mtu:%d len needed:%d", len_left, mtu, len);
969+ if (len_left < 11) /* 11 is 4/attr_id + 2/charset_id + 2/str_len + 3/1st timer/attr cnt & len */
970+ {
971+ return AVRC_STS_INTERNAL_ERR;
972+ }
973+ if (len > len_left)
974+ {
975+ AVRC_TRACE_ERROR("The buffer does not have enough room to hold the given data.");
976+ }
1007977 /* get the existing length, if any, and also the num attributes */
1008- p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
1009- p_data = p_start;
1010- UINT8_TO_BE_STREAM(p_data, p_rsp->pdu);
1011-
1012- param_len = 2; /* for status and num_attr*/
1013- for(xx = 0; xx < p_rsp->attr_count; xx++)
978+ p_start = (uint8_t *)(p_pkt + 1) + p_pkt->offset;
979+ p_data = p_len = p_start + 1; /* pdu */
980+ /* the existing len */
981+ BE_STREAM_TO_UINT16(len, p_data);
982+ p_num = p_data + 1;
983+ if (len == 0)
1014984 {
1015- /* 8 for attr_id, char_set_id, attr_value_len */
1016- param_len = param_len + 8 + p_rsp->p_attr_list[xx].name.str_len;
985+ /* first time initialize the attribute count */
986+ UINT8_TO_BE_STREAM(p_data, p_rsp->status);
987+ *p_num = 0;
988+ p_data++;
989+ len = 2;
990+ len_left -= 3;
1017991 }
1018- AVRC_TRACE_API(" param_len = %d ", param_len);
1019- UINT16_TO_BE_STREAM(p_data, param_len);
1020- UINT8_TO_BE_STREAM(p_data, p_rsp->status);
1021- UINT8_TO_BE_STREAM(p_data, p_rsp->attr_count);
1022-
1023- for (xx=0; xx < p_rsp->attr_count; xx++)
992+ else
1024993 {
1025- if ( !p_rsp->p_attr_list[xx].name.p_str )
1026- {
1027- p_rsp->p_attr_list[xx].name.str_len = 0;
1028- }
1029- UINT32_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].attr_id);
1030- UINT16_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].name.charset_id);
1031- UINT16_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].name.str_len);
1032- ARRAY_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].name.p_str, \
1033- p_rsp->p_attr_list[xx].name.str_len);
994+ p_data = p_start + p_pkt->len;
995+ }
996+ for (uint8_t xx = 0; (xx < p_rsp->num_attrs) && (len_left > 9); xx++)
997+ {
998+ (*p_num)++;
999+ UINT32_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].attr_id);
1000+ UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.charset_id);
1001+ UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.str_len);
1002+ len_left -= 8;
1003+ if (p_rsp->p_attrs[xx].name.str_len > len_left)
1004+ p_rsp->p_attrs[xx].name.str_len = len_left;
1005+ ARRAY_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.p_str,
1006+ p_rsp->p_attrs[xx].name.str_len);
1007+ len_left -= p_rsp->p_attrs[xx].name.str_len;
1008+ len += (p_rsp->p_attrs[xx].name.str_len + 8);
10341009 }
1010+ UINT16_TO_BE_STREAM(p_len, len);
10351011 p_pkt->len = (p_data - p_start);
10361012 return AVRC_STS_NO_ERROR;
10371013 }
@@ -1270,7 +1246,8 @@ tAVRC_STS AVRC_BldResponse( UINT8 handle, tAVRC_RESPONSE *p_rsp, BT_HDR **pp_pkt
12701246 break;
12711247
12721248 case AVRC_PDU_GET_ELEMENT_ATTR:
1273- status = avrc_bld_get_elem_attrs_rsp(&p_rsp->get_elem_attrs, p_pkt);
1249+ case AVRC_PDU_GET_ITEM_ATTRIBUTES:
1250+ status = avrc_bld_get_attrs_rsp(&p_rsp->get_attrs, p_pkt);
12741251 break;
12751252
12761253 case AVRC_PDU_GET_PLAY_STATUS:
@@ -1281,15 +1258,15 @@ tAVRC_STS AVRC_BldResponse( UINT8 handle, tAVRC_RESPONSE *p_rsp, BT_HDR **pp_pkt
12811258 status = avrc_bld_notify_rsp(&p_rsp->reg_notif, p_pkt);
12821259 break;
12831260
1284- case AVRC_PDU_REQUEST_CONTINUATION_RSP: /* 0x40 */
1261+ case AVRC_PDU_REQUEST_CONTINUATION_RSP:
12851262 status = avrc_bld_next_rsp(&p_rsp->continu, p_pkt);
12861263 break;
12871264
1288- case AVRC_PDU_ABORT_CONTINUATION_RSP: /* 0x41 */
1265+ case AVRC_PDU_ABORT_CONTINUATION_RSP:
12891266 status = avrc_bld_next_rsp(&p_rsp->abort, p_pkt);
12901267 break;
12911268
1292- case AVRC_PDU_SET_ADDRESSED_PLAYER: /*PDU 0x60*/
1269+ case AVRC_PDU_SET_ADDRESSED_PLAYER:
12931270 status = avrc_bld_set_address_player_rsp(&p_rsp->addr_player, p_pkt);
12941271 break;
12951272
@@ -1402,10 +1379,6 @@ tAVRC_STS AVRC_BldBrowseResponse( UINT8 handle, tAVRC_RESPONSE *p_rsp, BT_HDR **
14021379 status = avrc_bld_change_path_rsp(&p_rsp->chg_path, p_pkt);
14031380 break;
14041381
1405- case AVRC_PDU_GET_ITEM_ATTRIBUTES:
1406- status = avrc_bld_get_item_attrs_rsp(&p_rsp->get_attrs, p_pkt);
1407- break;
1408-
14091382 case AVRC_PDU_GET_TOTAL_NUMBER_OF_ITEMS:
14101383 status = avrc_bld_tot_num_items_rsp(&p_rsp->get_tot_items, p_pkt);
14111384 break;
--- a/stack/avrc/avrc_pars_ct.c
+++ b/stack/avrc/avrc_pars_ct.c
@@ -468,12 +468,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
468468
469469 if (len <= 0)
470470 {
471- p_result->get_elem_attrs.num_attr = 0;
471+ p_result->get_attrs.num_attrs = 0;
472472 break;
473473 }
474474 min_len += 1;
475475 BE_STREAM_TO_UINT8(num_attrs, p);
476- p_result->get_elem_attrs.num_attr = num_attrs;
476+ p_result->get_attrs.num_attrs = num_attrs;
477477 if (num_attrs)
478478 {
479479 tAVRC_ATTR_ENTRY *p_attrs =
@@ -515,7 +515,7 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
515515 p_attrs[i].name.p_str = NULL;
516516 }
517517 }
518- p_result->get_elem_attrs.p_attrs = p_attrs;
518+ p_result->get_attrs.p_attrs = p_attrs;
519519 }
520520 }
521521 break;
--- a/stack/include/avrc_defs.h
+++ b/stack/include/avrc_defs.h
@@ -1263,16 +1263,6 @@ typedef struct
12631263 tAVRC_APP_SETTING_TEXT *p_attrs;
12641264 } tAVRC_GET_APP_ATTR_TXT_RSP;
12651265
1266-/* GetElemAttrs */
1267-typedef struct
1268-{
1269- UINT8 pdu;
1270- tAVRC_STS status;
1271- UINT8 opcode; /* Op Code (copied from avrc_cmd.opcode by AVRC_BldResponse user. invalid one to generate according to pdu) */
1272- UINT8 num_attr;
1273- tAVRC_ATTR_ENTRY *p_attrs;
1274-} tAVRC_GET_ELEM_ATTRS_RSP;
1275-
12761266 /* GetPlayStatus */
12771267 typedef struct
12781268 {
@@ -1369,14 +1359,14 @@ typedef struct
13691359 UINT32 num_items;
13701360 } tAVRC_CHG_PATH_RSP;
13711361
1372-/* GetItemAttrs */
1362+/* GetItemAttrs, GetElemAttrs */
13731363 typedef struct
13741364 {
13751365 UINT8 pdu;
13761366 tAVRC_STS status;
13771367 UINT8 opcode; /* Op Code (copied from avrc_cmd.opcode by AVRC_BldResponse user. invalid one to generate according to pdu) */
1378- UINT8 attr_count;
1379- tAVRC_ATTR_ENTRY *p_attr_list;
1368+ uint8_t num_attrs;
1369+ tAVRC_ATTR_ENTRY *p_attrs;
13801370 } tAVRC_GET_ATTRS_RSP;
13811371
13821372 /* Search */
@@ -1419,7 +1409,6 @@ typedef union
14191409 tAVRC_GET_APP_ATTR_TXT_RSP get_app_val_txt; /* GetAppValueTxt */
14201410 tAVRC_RSP inform_charset; /* InformCharset */
14211411 tAVRC_RSP inform_battery_status; /* InformBatteryStatus */
1422- tAVRC_GET_ELEM_ATTRS_RSP get_elem_attrs; /* GetElemAttrs */
14231412 tAVRC_GET_PLAY_STATUS_RSP get_play_status; /* GetPlayStatus */
14241413 tAVRC_REG_NOTIF_RSP reg_notif; /* RegNotify */
14251414 tAVRC_RSP continu; /* Continue */
@@ -1430,7 +1419,7 @@ typedef union
14301419 tAVRC_SET_BR_PLAYER_RSP br_player; /* SetBrowsedPlayer */
14311420 tAVRC_GET_ITEMS_RSP get_items; /* GetFolderItems */
14321421 tAVRC_CHG_PATH_RSP chg_path; /* ChangePath */
1433- tAVRC_GET_ATTRS_RSP get_attrs; /* GetItemAttrs */
1422+ tAVRC_GET_ATTRS_RSP get_attrs; /* GetItemAttrs, GetElemAttrs */
14341423 tAVRC_SEARCH_RSP search; /* Search */
14351424 tAVRC_RSP play_item; /* PlayItem */
14361425 tAVRC_RSP add_to_play; /* AddToNowPlaying */