commit c498be3bf6f7a7ee84b40623db960308354f5a51
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jul 07 01:49:05 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jul 07 01:49:05 2022 +0000
tree 6bff8c3d5e51230c3616a189bdd97b0b8a7024e2
parent 5522e522a366aed1db2a00bdee1e0fdb80d6f799
parent 720268881ee24f0c478f56efed0a151721e49550

Merge cherrypicks of [16816453, 17570067] into sc-d2-release.

Change-Id: Iea54cbabb16aa09e085485ad87d344008ffe5a6f

stack/gatt/gatt_sr.cc

diff --git a/stack/gatt/gatt_sr.cc b/stack/gatt/gatt_sr.cc
index 9fe642c..0396bb1 100644
--- a/stack/gatt/gatt_sr.cc
+++ b/stack/gatt/gatt_sr.cc
@@ -173,6 +173,9 @@
 
     if (p_rsp != NULL) {
       total_len = (p_buf->len + p_rsp->attr_value.len);
+      if (p_cmd->multi_req.variable_len) {
+        total_len += 2;
+      }
 
       if (total_len > mtu) {
         /* just send the partial response for the overflow case */

stack/l2cap/l2c_ble.cc

diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index 16454a5..d548679 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -621,7 +621,7 @@
       break;
     }
     case L2CAP_CMD_CREDIT_BASED_CONN_RES:
-      if (p + 2 > p_pkt_end) {
+      if (p + 8 > p_pkt_end) {
         LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len";
         return;
       }