Merge cherrypicks of [13524839, 13524840, 13524841, 13524928, 13524929, 13524930, 13522744, 13524951, 13524860, 13524371, 13524372, 13524373, 13524374, 13524861, 13525166, 13525167, 13525168, 13524843, 13524957, 13524958, 13524936, 13525246, 13524939, 13524940, 13525248, 13524942, 13525249, 13525250, 13525251, 13524943, 13525169, 13525170, 13524358, 13524961, 13524962, 13524963, 13524966, 13524844, 13525325, 13525326, 13524964, 13525327, 13525328, 13524359, 13525307, 13525345] into rvc-qpr2-release
Change-Id: I2330a6164aa2cedbcff0e98410373d4b09e4f27b
diff --git a/stack/avrc/avrc_api.cc b/stack/avrc/avrc_api.cc
index 62b7fe4..1ac856a 100644
--- a/stack/avrc/avrc_api.cc
+++ b/stack/avrc/avrc_api.cc
@@ -237,7 +237,7 @@
static BT_HDR* avrc_copy_packet(BT_HDR* p_pkt, int rsp_pkt_len) {
const int offset = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
const int pkt_len = MAX(rsp_pkt_len, p_pkt->len);
- BT_HDR* p_pkt_copy = (BT_HDR*)osi_malloc(BT_HDR_SIZE + offset + pkt_len);
+ BT_HDR* p_pkt_copy = (BT_HDR*)osi_calloc(BT_HDR_SIZE + offset + pkt_len);
/* Copy the packet header, set the new offset, and copy the payload */
memcpy(p_pkt_copy, p_pkt, BT_HDR_SIZE);
@@ -316,7 +316,7 @@
if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {
int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
p_pkt_old = p_fcb->p_fmsg;
- p_pkt = (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
+ p_pkt = (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
p_pkt->len = AVRC_MAX_CTRL_DATA_LEN;
p_pkt->offset = AVCT_MSG_OFFSET;
p_pkt->layer_specific = p_pkt_old->layer_specific;
@@ -426,7 +426,7 @@
}
if (status != AVRC_STS_NO_ERROR) {
- p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+ p_rsp = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
p_rsp->offset = p_pkt->offset;
p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset;
*p_data++ = AVRC_RSP_REJ;
@@ -487,7 +487,7 @@
if (pkt_type == AVRC_PKT_START) {
/* Allocate buffer for re-assembly */
p_rcb->rasm_pdu = *p_data;
- p_rcb->p_rmsg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+ p_rcb->p_rmsg = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
/* Copy START packet to buffer for re-assembling fragments */
memcpy(p_rcb->p_rmsg, p_pkt, sizeof(BT_HDR)); /* Copy bt hdr */
@@ -922,7 +922,7 @@
CHECK(p_msg != NULL);
CHECK(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->pass_len));
- BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+ BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
p_cmd->offset = AVCT_MSG_OFFSET;
p_cmd->layer_specific = AVCT_DATA_CTRL;
@@ -1190,7 +1190,7 @@
if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN) {
int offset_len = MAX(AVCT_MSG_OFFSET, p_pkt->offset);
BT_HDR* p_pkt_new =
- (BT_HDR*)osi_malloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
+ (BT_HDR*)osi_calloc(AVRC_PACKET_LEN + offset_len + BT_HDR_SIZE);
if (p_start != NULL) {
p_fcb->frag_enabled = true;
p_fcb->p_fmsg = p_pkt;
diff --git a/stack/avrc/avrc_bld_ct.cc b/stack/avrc/avrc_bld_ct.cc
index 384ae60..4d85d17 100644
--- a/stack/avrc/avrc_bld_ct.cc
+++ b/stack/avrc/avrc_bld_ct.cc
@@ -536,7 +536,7 @@
}
/* allocate and initialize the buffer */
- BT_HDR* p_pkt = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);
+ BT_HDR* p_pkt = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
uint8_t *p_data, *p_start;
p_pkt->layer_specific = chnl;
diff --git a/stack/avrc/avrc_bld_tg.cc b/stack/avrc/avrc_bld_tg.cc
index 1dac160..73da345 100644
--- a/stack/avrc/avrc_bld_tg.cc
+++ b/stack/avrc/avrc_bld_tg.cc
@@ -1322,7 +1322,7 @@
}
/* allocate and initialize the buffer */
- BT_HDR* p_pkt = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+ BT_HDR* p_pkt = (BT_HDR*)osi_calloc(BT_DEFAULT_BUFFER_SIZE);
uint8_t *p_data, *p_start;
p_pkt->layer_specific = chnl;
diff --git a/stack/avrc/avrc_opt.cc b/stack/avrc/avrc_opt.cc
index de42e15..a9ad908 100644
--- a/stack/avrc/avrc_opt.cc
+++ b/stack/avrc/avrc_opt.cc
@@ -51,7 +51,7 @@
CHECK(p_msg != NULL);
CHECK(AVRC_META_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->vendor_len));
- p_cmd = (BT_HDR*)osi_malloc(AVRC_META_CMD_BUF_SIZE);
+ p_cmd = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
p_cmd->offset = AVCT_MSG_OFFSET;
p_data = (uint8_t*)(p_cmd + 1) + p_cmd->offset;
@@ -91,7 +91,7 @@
*
*****************************************************************************/
uint16_t AVRC_UnitCmd(uint8_t handle, uint8_t label) {
- BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+ BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
uint8_t* p_data;
p_cmd->offset = AVCT_MSG_OFFSET;
@@ -134,7 +134,7 @@
*
*****************************************************************************/
uint16_t AVRC_SubCmd(uint8_t handle, uint8_t label, uint8_t page) {
- BT_HDR* p_cmd = (BT_HDR*)osi_malloc(AVRC_CMD_BUF_SIZE);
+ BT_HDR* p_cmd = (BT_HDR*)osi_calloc(AVRC_CMD_BUF_SIZE);
uint8_t* p_data;
p_cmd->offset = AVCT_MSG_OFFSET;
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 7b64b86..7c63676 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -308,7 +308,7 @@
BE_STREAM_TO_UINT16(player->name.str_len, p);
min_len += player->name.str_len;
if (pkt_len < min_len) goto browse_length_error;
- player->name.p_str = (uint8_t*)osi_malloc(
+ player->name.p_str = (uint8_t*)osi_calloc(
(player->name.str_len + 1) * sizeof(uint8_t));
BE_STREAM_TO_ARRAY(p, player->name.p_str, player->name.str_len);
AVRC_TRACE_DEBUG(
@@ -336,7 +336,7 @@
BE_STREAM_TO_UINT16(folder->name.str_len, p);
min_len += folder->name.str_len;
if (pkt_len < min_len) goto browse_length_error;
- folder->name.p_str = (uint8_t*)osi_malloc(
+ folder->name.p_str = (uint8_t*)osi_calloc(
(folder->name.str_len + 1) * sizeof(uint8_t));
BE_STREAM_TO_ARRAY(p, folder->name.p_str, folder->name.str_len);
AVRC_TRACE_DEBUG("%s type %d playable %d cs %d name len %d",
@@ -488,7 +488,7 @@
AVRC_TRACE_DEBUG("%s AVRC_PDU_SET_BROWSED_PLAYER item: %d len: %d",
__func__, i, folder_name->str_len);
folder_name->p_str =
- (uint8_t*)osi_malloc((folder_name->str_len + 1) * sizeof(uint8_t));
+ (uint8_t*)osi_calloc((folder_name->str_len + 1) * sizeof(uint8_t));
BE_STREAM_TO_ARRAY(p, folder_name->p_str, folder_name->str_len);
}
break;
diff --git a/stack/btm/btm_sec.cc b/stack/btm/btm_sec.cc
index 5d7d0f9..bdda174 100644
--- a/stack/btm/btm_sec.cc
+++ b/stack/btm/btm_sec.cc
@@ -4674,6 +4674,13 @@
VLOG(2) << __func__ << " BDA: " << p_bda
<< " state: " << btm_pair_state_descr(btm_cb.pairing_state);
+ RawAddress local_bd_addr = *controller_get_interface()->get_address();
+ if (p_bda == local_bd_addr) {
+ android_errorWriteLog(0x534e4554, "174626251");
+ btsnd_hcic_pin_code_neg_reply(p_bda);
+ return;
+ }
+
if (btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) {
if ((p_bda == btm_cb.pairing_bda) &&
(btm_cb.pairing_state == BTM_PAIR_STATE_WAIT_AUTH_COMPLETE)) {
