Merge "Fix crash in smp_br_state_machine_event" into rvc-qpr-dev
diff --git a/device/include/interop_database.h b/device/include/interop_database.h
index 3a969ef..54d8bd1 100644
--- a/device/include/interop_database.h
+++ b/device/include/interop_database.h
@@ -151,6 +151,9 @@
     // because BR/EDR address and ADV random address are the same
     {{{0xd4, 0x7a, 0xe2, 0, 0, 0}}, 3, INTEROP_DISABLE_NAME_REQUEST},
 
+    // Mazda Carkit
+    {{{0xfc, 0x35, 0xe6, 0, 0, 0}}, 3, INTEROP_AVRCP_1_4_ONLY},
+
     // Toyota Car Audio
     {{{0x00, 0x17, 0x53, 0, 0, 0}}, 3, INTEROP_AVRCP_1_4_ONLY},
 
diff --git a/gd/hal/hci_hal_host_rootcanal_test.cc b/gd/hal/hci_hal_host_rootcanal_test.cc
index 9783e84..aeff6a8 100644
--- a/gd/hal/hci_hal_host_rootcanal_test.cc
+++ b/gd/hal/hci_hal_host_rootcanal_test.cc
@@ -172,9 +172,9 @@
 
 void check_packet_equal(std::pair<uint8_t, HciPacket> hci_packet1_type_data_pair, H4Packet h4_packet2) {
   auto packet1_hci_size = hci_packet1_type_data_pair.second.size();
-  EXPECT_EQ(packet1_hci_size + 1, h4_packet2.size());
-  EXPECT_EQ(hci_packet1_type_data_pair.first, h4_packet2[0]);
-  EXPECT_EQ(memcmp(hci_packet1_type_data_pair.second.data(), h4_packet2.data() + 1, packet1_hci_size), 0);
+  ASSERT_EQ(packet1_hci_size + 1, h4_packet2.size());
+  ASSERT_EQ(hci_packet1_type_data_pair.first, h4_packet2[0]);
+  ASSERT_EQ(memcmp(hci_packet1_type_data_pair.second.data(), h4_packet2.data() + 1, packet1_hci_size), 0);
 }
 
 HciPacket make_sample_hci_cmd_pkt(uint8_t parameter_total_length) {
@@ -223,6 +223,16 @@
   return pkt;
 }
 
+size_t read_with_retry(int socket, uint8_t* data, size_t length) {
+  size_t bytes_read = 0;
+  ssize_t bytes_read_current = 0;
+  do {
+    bytes_read_current = read(socket, data + bytes_read, length - bytes_read);
+    bytes_read += bytes_read_current;
+  } while (length > bytes_read && bytes_read_current > 0);
+  return bytes_read;
+}
+
 TEST_F(HciHalRootcanalTest, init_and_close) {}
 
 TEST_F(HciHalRootcanalTest, receive_hci_evt) {
@@ -319,9 +329,9 @@
   hal_->sendHciCommand(hci_data);
   H4Packet read_buf(1 + 2 + 1 + hci_cmd_param_size);
   SetFakeServerSocketToBlocking();
-  auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
+  auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
 
-  EXPECT_EQ(size_read, 1 + hci_data.size());
+  ASSERT_EQ(size_read, 1 + hci_data.size());
   check_packet_equal({kH4Command, hci_data}, read_buf);
 }
 
@@ -331,9 +341,9 @@
   hal_->sendAclData(acl_packet);
   H4Packet read_buf(1 + 2 + 2 + acl_payload_size);
   SetFakeServerSocketToBlocking();
-  auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
+  auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
 
-  EXPECT_EQ(size_read, 1 + acl_packet.size());
+  ASSERT_EQ(size_read, 1 + acl_packet.size());
   check_packet_equal({kH4Acl, acl_packet}, read_buf);
 }
 
@@ -343,9 +353,9 @@
   hal_->sendScoData(sco_packet);
   H4Packet read_buf(1 + 3 + sco_payload_size);
   SetFakeServerSocketToBlocking();
-  auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
+  auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
 
-  EXPECT_EQ(size_read, 1 + sco_packet.size());
+  ASSERT_EQ(size_read, 1 + sco_packet.size());
   check_packet_equal({kH4Sco, sco_packet}, read_buf);
 }
 
@@ -359,8 +369,8 @@
   H4Packet read_buf(1 + 2 + 2 + acl_payload_size);
   SetFakeServerSocketToBlocking();
   for (int i = 0; i < num_packets; i++) {
-    auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
-    EXPECT_EQ(size_read, 1 + acl_packet.size());
+    auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
+    ASSERT_EQ(size_read, 1 + acl_packet.size());
     check_packet_equal({kH4Acl, acl_packet}, read_buf);
   }
 }
@@ -373,8 +383,8 @@
   for (int i = 0; i < num_packets; i++) {
     hal_->sendAclData(acl_packet);
     H4Packet read_buf(1 + 2 + 2 + acl_payload_size);
-    auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
-    EXPECT_EQ(size_read, 1 + acl_packet.size());
+    auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
+    ASSERT_EQ(size_read, 1 + acl_packet.size());
     check_packet_equal({kH4Acl, acl_packet}, read_buf);
   }
 }
@@ -382,7 +392,7 @@
 TEST(HciHalHidlTest, serialize) {
   std::vector<uint8_t> bytes = {1, 2, 3, 4, 5, 6, 7, 8, 9};
   auto packet_bytes = hal::SerializePacket(std::unique_ptr<packet::BasePacketBuilder>(new packet::RawBuilder(bytes)));
-  EXPECT_EQ(bytes, packet_bytes);
+  ASSERT_EQ(bytes, packet_bytes);
 }
 }  // namespace
 }  // namespace hal
diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index fe1db3d..f2396b4 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -71,6 +71,8 @@
       break;
     }
     case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */
+      if (len < 5) return AVRC_STS_INTERNAL_ERR;
+
       BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
       BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);
       break;