fix(ble/bluedroid): fix direct-connect cleanup and adv bounds

components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c

@@ -859,6 +859,35 @@ void btm_ble_enqueue_direct_conn_req(void *p_param)
 }
 /*******************************************************************************
 **
+** Function         btm_ble_remove_direct_conn_req
+**
+** Description      Remove a pending direct connection request for the given LCB.
+**
+** Returns          None.
+**
+*******************************************************************************/
+void btm_ble_remove_direct_conn_req(void *p_param)
+{
+    fixed_queue_t *q = btm_cb.ble_ctr_cb.conn_pending_q;
+
+    if (q == NULL || p_param == NULL) {
+        return;
+    }
+
+    list_t *list = fixed_queue_get_list(q);
+    for (const list_node_t *node = list_begin(list); node != NULL; node = list_next(node)) {
+        tBTM_BLE_CONN_REQ *p = (tBTM_BLE_CONN_REQ *)list_node(node);
+
+        if (p->p_param == p_param) {
+            if (fixed_queue_try_remove_from_queue(q, p) != NULL) {
+                osi_free(p);
+            }
+            break;
+        }
+    }
+}
+/*******************************************************************************
+**
 ** Function         btm_send_pending_direct_conn
 **
 ** Description      This function send the pending direct connection request in queue
@@ -873,7 +902,17 @@ BOOLEAN btm_send_pending_direct_conn(void)
 
     p_req = (tBTM_BLE_CONN_REQ*)fixed_queue_dequeue(btm_cb.ble_ctr_cb.conn_pending_q, 0);
     if (p_req != NULL) {
-        rt = l2cble_init_direct_conn((tL2C_LCB *)(p_req->p_param));
+        tL2C_LCB *p_lcb = (tL2C_LCB *)(p_req->p_param);
+
+        if (p_lcb == NULL || !p_lcb->in_use) {
+            osi_free((void *)p_req);
+            return FALSE;
+        }
+
+        rt = l2cble_init_direct_conn(p_lcb);
+        if (!rt) {
+            l2cu_release_lcb(p_lcb);
+        }
 
         osi_free((void *)p_req);
     }

components/bt/host/bluedroid/stack/btm/btm_ble_gap.c

@@ -1841,7 +1841,7 @@ UINT8 *btm_ble_build_adv_data(tBTM_BLE_AD_MASK *p_data_mask, UINT8 **p_dst,
         if (len > MIN_ADV_LENGTH && data_mask & BTM_BLE_AD_BIT_SERVICE_DATA &&
                 p_data && p_data->p_service_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) {
             if (len  > (p_data->p_service_data->service_uuid.len + MIN_ADV_LENGTH)) {
-                if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH)) {
+                if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len)) {
                     cp_len = len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len;
                 } else {
                     cp_len = p_data->p_service_data->len;
@@ -2895,6 +2895,9 @@ void btm_send_sel_conn_callback(BD_ADDR remote_bda, UINT8 evt_type, UINT8 *p_dat
         }
 
         if (p_dev_name) {
+            if (len > sizeof(remname) - 1) {
+                len = sizeof(remname) - 1;
+            }
             memcpy(remname, p_dev_name, len);
         }
     }
@@ -3018,6 +3021,10 @@ void btm_ble_process_adv_pkt (UINT8 *p_data, UINT8 evt_len)
 #endif
         /* Validate data_len before any path (callee reads 1 + data_len + 1 = data_len+2 bytes from p) */
         data_len = *p; /* read without advancing; p points to data_len byte */
+        if (data_len > BTM_BLE_ADV_DATA_LEN_MAX) {
+            BTM_TRACE_ERROR("btm_ble_process_adv_pkt: legacy adv data_len %u exceeds max %u", data_len, BTM_BLE_ADV_DATA_LEN_MAX);
+            break;
+        }
         if (data_len + 2 > remaining - 8) {
             BTM_TRACE_ERROR("btm_ble_process_adv_pkt: data_len %u + data + rssi exceeds remaining %u", data_len, (UINT16)(remaining - 8));
             break;

components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h

@@ -480,6 +480,7 @@ void btm_ble_update_link_topology_mask(UINT8 role, BOOLEAN increase);
 /* direct connection utility */
 BOOLEAN btm_send_pending_direct_conn(void);
 void btm_ble_enqueue_direct_conn_req(void *p_param);
+void btm_ble_remove_direct_conn_req(void *p_param);
 
 /* BLE address management */
 void btm_gen_resolvable_private_addr (void *p_cmd_cplt_cback);