commit 2a2701cdddac0859a95e58aec542742c450145b9
author Kim Schulz <k.schulz@samsung.com> Mon Sep 16 15:59:33 2013 +0200
committer Zhihai Xu <zhihaixu@google.com> Mon Dec 16 14:00:41 2013 -0800
tree cbb4352c8816576e12ed34531fe3727fac0c033b
parent 41b33913995e5baf53461fe50f836717c2a47db9

Fixes for problems found with coverity analyzer

- fixed UNINITIALIZED variable (hdl) in bta_hh_act.c :220
- fixed possible RESOURCE LEAK in btif_config_util.cpp in relation to open_file_map() if file is fd size=0
- fixed possible RESOURCE LEAK in create_socket_server() in uipc:196 (s not closed)
- fixed possible OVERRUN in  l2c_csm.c, (l2c_csm_config), array "l2cb.fixed_reg" of 4 20-byte elements at element index 60 (byte offset 1200) using index "p_ccb->local_cid - 3" (which evaluates to 60)
- fixed possible OVERRUN in btm_pm.c, (btm_pm_reset) array "btm_cb.acl_db" of 7 288-byte elements at element index 7 (byte offset 2016) using index "btm_cb.pm_pend_link" (which evaluates to 7).
- fixed possible OVERRUN in btif_storage.c, (btif_storage_add_device_to_autopair_blacklist) array "input_value" of 20 bytes by passing it to a function which accesses it at byte offset 20 using argument "20U".
patch set 2:
- fixed {}
Patch set 3:
- fixed review commment in stack/btm/btm_pm.c:379

bug: 10777562
Change-Id: I2a6d57f93acaaf9b25c49a6a29cb60d0e1e3c5d8

stack/l2cap/l2c_csm.c

diff --git a/stack/l2cap/l2c_csm.c b/stack/l2cap/l2c_csm.c
index 0d04d8a..4e24c23 100644
--- a/stack/l2cap/l2c_csm.c
+++ b/stack/l2cap/l2c_csm.c
@@ -892,14 +892,17 @@
     case L2CEVT_L2CAP_DATA:                        /* Peer data packet rcvd    */
         L2CAP_TRACE_API1 ("L2CAP - Calling DataInd_Cb(), CID: 0x%04x", p_ccb->local_cid);
 #if (L2CAP_NUM_FIXED_CHNLS > 0)
-        if (p_ccb->local_cid < L2CAP_BASE_APPL_CID)
+        if (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL &&
+                p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL)
         {
-            if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
-                (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(p_ccb->p_lcb->remote_bd_addr,(BT_HDR *)p_data);
-            else
-                GKI_freebuf (p_data);
-
+            if (p_ccb->local_cid < L2CAP_BASE_APPL_CID)
+            {
+                if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
+                    (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(p_ccb->p_lcb->remote_bd_addr,(BT_HDR *)p_data);
+                else
+                    GKI_freebuf (p_data);
             break;
+            }
         }
 #endif
         (*p_ccb->p_rcb->api.pL2CA_DataInd_Cb)(p_ccb->local_cid, (BT_HDR *)p_data);