Merge cherrypicks of [4902694, 4902725, 4902587, 4902588, 4902761, 4902762] into pi-release-2
Change-Id: I8f51b4ae454edb9a785e40aa97bf09b4c308b2b0
diff --git a/stack/include/rfcdefs.h b/stack/include/rfcdefs.h
index aba555d..ca9b3ce 100644
--- a/stack/include/rfcdefs.h
+++ b/stack/include/rfcdefs.h
@@ -89,13 +89,6 @@
(pf) = (*(p_data)++ & RFCOMM_PF_MASK) >> RFCOMM_PF_OFFSET; \
}
-#define RFCOMM_PARSE_LEN_FIELD(ea, length, p_data) \
- { \
- (ea) = (*(p_data)&RFCOMM_EA); \
- (length) = (*(p_data)++ >> RFCOMM_SHIFT_LENGTH1); \
- if (!(ea)) (length) += (*(p_data)++ << RFCOMM_SHIFT_LENGTH2); \
- }
-
#define RFCOMM_FRAME_IS_CMD(initiator, cr) \
(((initiator) && !(cr)) || (!(initiator) && (cr)))
diff --git a/stack/rfcomm/rfc_ts_frames.cc b/stack/rfcomm/rfc_ts_frames.cc
index 8b21e3c..e3b4b8f 100644
--- a/stack/rfcomm/rfc_ts_frames.cc
+++ b/stack/rfcomm/rfc_ts_frames.cc
@@ -517,7 +517,16 @@
return (RFC_EVENT_BAD_FRAME);
}
RFCOMM_PARSE_TYPE_FIELD(p_frame->type, p_frame->pf, p_data);
- RFCOMM_PARSE_LEN_FIELD(eal, len, p_data);
+
+ eal = *(p_data)&RFCOMM_EA;
+ len = *(p_data)++ >> RFCOMM_SHIFT_LENGTH1;
+ if (eal == 0 && p_buf->len > RFCOMM_CTRL_FRAME_LEN) {
+ len += (*(p_data)++ << RFCOMM_SHIFT_LENGTH2);
+ } else if (eal == 0) {
+ RFCOMM_TRACE_ERROR("Bad Length when EAL = 0: %d", p_buf->len);
+ android_errorWriteLog(0x534e4554, "78288018");
+ return RFC_EVENT_BAD_FRAME;
+ }
p_buf->len -= (3 + !ead + !eal + 1); /* Additional 1 for FCS */
p_buf->offset += (3 + !ead + !eal);