Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt): fix A2DP bta component issues reported by AI review

Browse Source
This commit is contained in:
yangfeng
2026-04-24 19:21:19 +08:00
parent e812f543d1
commit d4752ccdd5
10 changed files with 188 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/bta/ar/bta_ar.c
+13 -10
View File
@@ -146,10 +146,11 @@ void bta_ar_dereg_avdt(tBTA_SYS_ID sys_id)
bta_ar_cb.p_avk_conn_cback = NULL;
mask = BTA_AR_AVK_MASK;
}
bta_ar_cb.avdt_registered &= ~mask;
if (bta_ar_cb.avdt_registered == 0) {
AVDT_Deregister();
if (mask) {
bta_ar_cb.avdt_registered &= ~mask;
if (bta_ar_cb.avdt_registered == 0) {
AVDT_Deregister();
}
}
}
@@ -170,6 +171,7 @@ void bta_ar_avdt_conn(tBTA_SYS_ID sys_id, BD_ADDR bd_addr)
UINT8 event = BTA_AR_AVDT_CONN_EVT;
tAVDT_CTRL data;
memset(&data, 0, sizeof(tAVDT_CTRL));
if (sys_id == BTA_ID_AV) {
if (bta_ar_cb.p_avk_conn_cback) {
(*bta_ar_cb.p_avk_conn_cback)(0, bd_addr, event, &data);
@@ -215,10 +217,11 @@ void bta_ar_dereg_avct(tBTA_SYS_ID sys_id)
{
UINT8 mask = bta_ar_id (sys_id);
bta_ar_cb.avct_registered &= ~mask;
if (bta_ar_cb.avct_registered == 0) {
AVCT_Deregister();
if (mask) {
bta_ar_cb.avct_registered &= ~mask;
if (bta_ar_cb.avct_registered == 0) {
AVCT_Deregister();
}
}
}
@@ -299,12 +302,12 @@ void bta_ar_dereg_avrc(UINT16 service_uuid, tBTA_SYS_ID sys_id)
bta_ar_cb.ct_categories [mask - 1] = 0;
categories = bta_ar_cb.ct_categories[0] | bta_ar_cb.ct_categories[1];
if (!categories) {
/* no CT is still registered - cleaup */
/* no CT is still registered - cleanup */
SDP_DeleteRecord(bta_ar_cb.sdp_ct_handle);
bta_ar_cb.sdp_ct_handle = 0;
bta_sys_remove_uuid(service_uuid);
} else {
/* change supported categories to the remaning one */
/* change supported categories to the remaining one */
p = temp;
UINT16_TO_BE_STREAM(p, categories);
SDP_AddAttribute(bta_ar_cb.sdp_ct_handle, ATTR_ID_SUPPORTED_FEATURES, UINT_DESC_TYPE,
components/bt/host/bluedroid/bta/av/bta_av_aact.c
+38 -9
View File
@@ -522,6 +522,11 @@ static void bta_av_proc_stream_evt(UINT8 handle, BD_ADDR bd_addr, UINT8 event, t
}
/* look up application event */
/* bounds check to avoid out-of-bounds read */
if (event >= sizeof(bta_av_stream_evt_ok) / sizeof(bta_av_stream_evt_ok[0])) {
osi_free(p_msg);
return;
}
if ((p_data == NULL) || (p_data->hdr.err_code == 0)) {
p_msg->hdr.event = bta_av_stream_evt_ok[event];
if (p_msg->hdr.event == BTA_AV_STR_START_OK_EVT) {
@@ -582,7 +587,7 @@ void bta_av_stream_data_cback(UINT8 handle, BT_HDR *p_pkt, UINT32 time_stamp, UI
/* Get SCB and correct sep type*/
for (index = 0; index < BTA_AV_NUM_STRS; index ++ ) {
p_scb = bta_av_cb.p_scb[index];
if ((p_scb->avdt_handle == handle) && (p_scb->seps[p_scb->sep_idx].tsep == AVDT_TSEP_SNK)) {
if (p_scb && (p_scb->avdt_handle == handle) && (p_scb->seps[p_scb->sep_idx].tsep == AVDT_TSEP_SNK)) {
break;
}
}
@@ -722,6 +727,7 @@ static void bta_av_a2d_sdp_cback(BOOLEAN found, tA2D_Service *p_service)
bta_sys_sendmsg(p_msg);
} else {
APPL_TRACE_ERROR ("bta_av_a2d_sdp_cback, no scb found for handle(0x%x)", bta_av_cb.handle);
osi_free(p_msg);
}
}
}
@@ -1633,7 +1639,7 @@ void bta_av_disc_results (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
p_data->str_msg.msg.discover_cfm.p_sep_info[i].tsep
);
}
for (i = 0; i < p_scb->num_seps; i++) {
for (i = 0; i < num_seps; i++) {
/* steam not in use, is a sink, and is audio */
if ((p_scb->sep_info[i].in_use == FALSE) &&
(p_scb->sep_info[i].media_type == p_scb->media_type)) {
@@ -1873,6 +1879,11 @@ void bta_av_getcap_results (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
UINT16 uuid_int; /* UUID for which connection was initiated */
tBTA_AV_SNK_PSC_CFG psc_cfg = {0};
if (p_scb->p_cap == NULL) {
APPL_TRACE_ERROR("bta_av_getcap_results: p_cap is NULL");
bta_av_ssm_execute(p_scb, BTA_AV_STR_GETCAP_FAIL_EVT, p_data);
return;
}
memcpy(&cfg, &p_scb->cfg, sizeof(tAVDT_CFG));
cfg.num_codec = 1;
cfg.num_protect = p_scb->p_cap->num_protect;
@@ -2167,9 +2178,9 @@ void bta_av_reconfig (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
bta_sys_stop_timer(&p_scb->timer);
memcpy(p_cfg, &p_scb->cfg, sizeof(tAVDT_CFG));
p_cfg->num_protect = p_rcfg->num_protect;
p_cfg->num_protect = (p_rcfg->num_protect <= AVDT_PROTECT_SIZE) ? p_rcfg->num_protect : AVDT_PROTECT_SIZE;
memcpy(p_cfg->codec_info, p_rcfg->codec_info, AVDT_CODEC_SIZE);
memcpy(p_cfg->protect_info, p_rcfg->p_protect_info, p_rcfg->num_protect);
memcpy(p_cfg->protect_info, p_rcfg->p_protect_info, p_cfg->num_protect);
p_scb->rcfg_idx = p_rcfg->sep_info_idx;
p_scb->p_cap->psc_mask = p_scb->cur_psc_mask;
@@ -2382,7 +2393,12 @@ void bta_av_start_ok (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
* If the code were to be re-arranged for some reasons, this number may need to be changed
*/
p_scb->co_started = bta_av_cb.audio_open_cnt;
flush_to = p_bta_av_cfg->p_audio_flush_to[p_scb->co_started - 1];
if (p_scb->co_started > 0) {
flush_to = p_bta_av_cfg->p_audio_flush_to[p_scb->co_started - 1];
} else {
APPL_TRACE_ERROR("bta_av_start_ok: co_started is 0");
flush_to = p_bta_av_cfg->p_audio_flush_to[0];
}
} else {
flush_to = p_bta_av_cfg->video_flush_to;
}
@@ -2774,7 +2790,11 @@ void bta_av_suspend_cont (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
if (AVDT_ERR_CONNECT == err_code) {
/* report failure */
evt.status = BTA_AV_FAIL;
(*bta_av_cb.p_cback)(BTA_AV_RECONFIG_EVT, (tBTA_AV *)&evt);
evt.chnl = p_scb->chnl;
evt.hndl = p_scb->hndl;
if (bta_av_cb.p_cback) {
(*bta_av_cb.p_cback)(BTA_AV_RECONFIG_EVT, (tBTA_AV *)&evt);
}
bta_av_ssm_execute(p_scb, BTA_AV_STR_DISC_FAIL_EVT, NULL);
} else {
APPL_TRACE_ERROR("suspend rejected, try close");
@@ -2790,9 +2810,18 @@ void bta_av_suspend_cont (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
} else {
APPL_TRACE_DEBUG("bta_av_suspend_cont calling AVDT_ReconfigReq");
/* reconfig the stream */
AVDT_ReconfigReq(p_scb->avdt_handle, p_scb->p_cap);
p_scb->p_cap->psc_mask = p_scb->cur_psc_mask;
if (p_scb->p_cap == NULL) {
evt.status = BTA_AV_FAIL;
evt.chnl = p_scb->chnl;
evt.hndl = p_scb->hndl;
if (bta_av_cb.p_cback) {
(*bta_av_cb.p_cback)(BTA_AV_RECONFIG_EVT, (tBTA_AV *)&evt);
}
bta_av_ssm_execute(p_scb, BTA_AV_STR_DISC_FAIL_EVT, NULL);
} else {
AVDT_ReconfigReq(p_scb->avdt_handle, p_scb->p_cap);
p_scb->p_cap->psc_mask = p_scb->cur_psc_mask;
}
}
}
components/bt/host/bluedroid/bta/av/bta_av_act.c
+39 -9
View File
@@ -290,12 +290,18 @@ UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
tAVRC_CONN_CB ccb;
BD_ADDR_PTR bda = (BD_ADDR_PTR)bd_addr_any;
UINT8 status = BTA_AV_RC_ROLE_ACP;
tBTA_AV_SCB *p_scb = p_cb->p_scb[shdl - 1];
tBTA_AV_SCB *p_scb = NULL;
int i;
UINT8 rc_handle;
tBTA_AV_RCB *p_rcb;
if (shdl > 0 && shdl <= BTA_AV_NUM_STRS) {
p_scb = p_cb->p_scb[shdl - 1];
}
if (role == AVCT_INT) {
if (p_scb == NULL) {
return BTA_AV_RC_HANDLE_NONE;
}
bda = p_scb->peer_addr;
status = BTA_AV_RC_ROLE_INT;
} else {
@@ -317,6 +323,11 @@ UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
return BTA_AV_RC_HANDLE_NONE;
}
if (rc_handle >= BTA_AV_NUM_RCB) {
APPL_TRACE_ERROR("bta_av_rc_create: EINVAL rc_handle %u", rc_handle);
AVRC_Close(rc_handle);
return BTA_AV_RC_HANDLE_NONE;
}
i = rc_handle;
p_rcb = &p_cb->rcb[i];
@@ -826,7 +837,7 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
tBTA_AV av;
BT_HDR *p_pkt = NULL;
tAVRC_MSG_VENDOR *p_vendor = &p_data->rc_msg.msg.vendor;
BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ));
#if (AVRC_METADATA_INCLUDED == TRUE)
UINT8 ctype = 0;
tAVRC_RESPONSE rc_rsp;
@@ -928,7 +939,9 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
/* else if not configured to support vendor specific and it's a command */
else if (!(p_cb->features & BTA_AV_FEAT_VENDOR) &&
p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ) {
if (p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID) {
if (p_data->rc_msg.msg.vendor.p_vendor_data != NULL &&
p_data->rc_msg.msg.vendor.vendor_len >= 5 &&
p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID) {
/* reject it */
p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
@@ -1637,11 +1650,16 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
/* cannot create valid rc_handle for current device. report failure */
APPL_TRACE_ERROR("%s: no link resources available", __func__);
p_scb->use_rc = FALSE;
rc_open.rc_handle = BTA_AV_RC_HANDLE_NONE;
bdcpy(rc_open.peer_addr, p_scb->peer_addr);
rc_open.peer_features = 0;
rc_open.peer_ct_features = 0;
rc_open.peer_tg_features = 0;
rc_open.sdp_disc_done = FALSE;
rc_open.status = BTA_AV_FAIL_SDP;
(*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
if (p_cb->p_cback) {
(*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
}
}
}
#if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
@@ -1652,11 +1670,16 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
} else if (p_scb->use_rc) {
/* can not find AVRC on peer device. report failure */
p_scb->use_rc = FALSE;
rc_open.rc_handle = BTA_AV_RC_HANDLE_NONE;
bdcpy(rc_open.peer_addr, p_scb->peer_addr);
rc_open.peer_features = 0;
rc_open.peer_ct_features = 0;
rc_open.peer_tg_features = 0;
rc_open.sdp_disc_done = FALSE;
rc_open.status = BTA_AV_FAIL_SDP;
(*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
if (p_cb->p_cback) {
(*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
}
}
}
} else {
@@ -1667,7 +1690,9 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
rc_feat.peer_features = peer_features;
rc_feat.peer_ct_features = peer_ct_features;
rc_feat.peer_tg_features = peer_tg_features;
(*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
if (p_cb->p_cback) {
(*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
}
}
}
@@ -1791,12 +1816,17 @@ void bta_av_rc_disc(UINT8 disc)
if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK) {
/* this is the rc handle/index to tBTA_AV_RCB */
rc_handle = disc & (~BTA_AV_CHNL_MSK);
if (p_cb->rcb[rc_handle].lidx) {
if (rc_handle < BTA_AV_NUM_RCB && p_cb->rcb[rc_handle].lidx > 0 &&
p_cb->rcb[rc_handle].lidx <= (BTA_AV_NUM_LINKS + 1)) {
p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx - 1].addr;
}
} else {
hdi = (disc & BTA_AV_HNDL_MSK) - 1;
p_scb = p_cb->p_scb[hdi];
hdi = (disc & BTA_AV_HNDL_MSK);
if (hdi > 0 && (hdi - 1) < BTA_AV_NUM_STRS) {
p_scb = p_cb->p_scb[hdi - 1];
} else {
p_scb = NULL;
}
if (p_scb) {
APPL_TRACE_DEBUG("rc_handle %d", p_scb->rc_handle);
components/bt/host/bluedroid/bta/av/bta_av_api.c
+31 -4
View File
@@ -117,6 +117,7 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
p_buf->hdr.event = BTA_AV_API_REGISTER_EVT;
if (p_service_name) {
BCM_STRNCPY_S(p_buf->p_service_name, p_service_name, BTA_SERVICE_NAME_LEN);
p_buf->p_service_name[BTA_SERVICE_NAME_LEN] = '\0';
} else {
p_buf->p_service_name[0] = '\0';
}
@@ -327,8 +328,14 @@ void BTA_AvReconfig(tBTA_AV_HNDL hndl, BOOLEAN suspend, UINT8 sep_info_idx,
void BTA_AvProtectReq(tBTA_AV_HNDL hndl, UINT8 *p_data, UINT16 len)
{
tBTA_AV_API_PROTECT_REQ *p_buf;
size_t alloc_size;
if ((p_buf = (tBTA_AV_API_PROTECT_REQ *) osi_malloc((UINT16) (sizeof(tBTA_AV_API_PROTECT_REQ) + len))) != NULL) {
/* Cap allocation size to avoid UINT16 overflow */
alloc_size = sizeof(tBTA_AV_API_PROTECT_REQ) + len;
if (alloc_size > 0xFFFF) {
return;
}
if ((p_buf = (tBTA_AV_API_PROTECT_REQ *) osi_malloc((UINT16) alloc_size)) != NULL) {
p_buf->hdr.layer_specific = hndl;
p_buf->hdr.event = BTA_AV_API_PROTECT_REQ_EVT;
p_buf->len = len;
@@ -357,8 +364,14 @@ void BTA_AvProtectReq(tBTA_AV_HNDL hndl, UINT8 *p_data, UINT16 len)
void BTA_AvProtectRsp(tBTA_AV_HNDL hndl, UINT8 error_code, UINT8 *p_data, UINT16 len)
{
tBTA_AV_API_PROTECT_RSP *p_buf;
size_t alloc_size;
if ((p_buf = (tBTA_AV_API_PROTECT_RSP *) osi_malloc((UINT16) (sizeof(tBTA_AV_API_PROTECT_RSP) + len))) != NULL) {
/* Cap allocation size to avoid UINT16 overflow */
alloc_size = sizeof(tBTA_AV_API_PROTECT_RSP) + len;
if (alloc_size > UINT16_MAX) {
return;
}
if ((p_buf = (tBTA_AV_API_PROTECT_RSP *) osi_malloc((UINT16) alloc_size)) != NULL) {
p_buf->hdr.layer_specific = hndl;
p_buf->hdr.event = BTA_AV_API_PROTECT_RSP_EVT;
p_buf->len = len;
@@ -452,8 +465,14 @@ void BTA_AvRemoteCmd(UINT8 rc_handle, UINT8 label, tBTA_AV_RC rc_id, tBTA_AV_STA
void BTA_AvVendorCmd(UINT8 rc_handle, UINT8 label, tBTA_AV_CODE cmd_code, UINT8 *p_data, UINT16 len)
{
tBTA_AV_API_VENDOR *p_buf;
size_t alloc_size;
if ((p_buf = (tBTA_AV_API_VENDOR *) osi_malloc((UINT16) (sizeof(tBTA_AV_API_VENDOR) + len))) != NULL) {
/* Cap allocation size to avoid UINT16 overflow */
alloc_size = sizeof(tBTA_AV_API_VENDOR) + len;
if (alloc_size > UINT16_MAX) {
return;
}
if ((p_buf = (tBTA_AV_API_VENDOR *) osi_malloc((UINT16) alloc_size)) != NULL) {
p_buf->hdr.event = BTA_AV_API_VENDOR_CMD_EVT;
p_buf->hdr.layer_specific = rc_handle;
p_buf->msg.hdr.ctype = cmd_code;
@@ -487,8 +506,14 @@ void BTA_AvVendorCmd(UINT8 rc_handle, UINT8 label, tBTA_AV_CODE cmd_code, UINT8
void BTA_AvVendorRsp(UINT8 rc_handle, UINT8 label, tBTA_AV_CODE rsp_code, UINT8 *p_data, UINT16 len, UINT32 company_id)
{
tBTA_AV_API_VENDOR *p_buf;
size_t alloc_size;
if ((p_buf = (tBTA_AV_API_VENDOR *) osi_malloc((UINT16) (sizeof(tBTA_AV_API_VENDOR) + len))) != NULL) {
/* Cap allocation size to avoid UINT16 overflow */
alloc_size = sizeof(tBTA_AV_API_VENDOR) + len;
if (alloc_size > 0xFFFF) {
return;
}
if ((p_buf = (tBTA_AV_API_VENDOR *) osi_malloc((UINT16) alloc_size)) != NULL) {
p_buf->hdr.event = BTA_AV_API_VENDOR_RSP_EVT;
p_buf->hdr.layer_specific = rc_handle;
p_buf->msg.hdr.ctype = rsp_code;
@@ -610,6 +635,8 @@ void BTA_AvMetaCmd(UINT8 rc_handle, UINT8 label, tBTA_AV_CMD cmd_code, BT_HDR *p
p_buf->label = label;
bta_sys_sendmsg(p_buf);
} else if (p_pkt) {
osi_free(p_pkt);
}
}
components/bt/host/bluedroid/bta/av/bta_av_cfg.c
+2 -2
View File
@@ -61,7 +61,7 @@ const UINT16 bta_av_audio_flush_to[] = {
0 /* 5 streams */
}; /* AVDTP audio transport channel flush timeout */
/* Note: Android doesnt support AVRC_SUPF_TG_GROUP_NAVI */
/* Note: Android doesn't support AVRC_SUPF_TG_GROUP_NAVI */
/* Note: if AVRC_SUPF_TG_GROUP_NAVI is set, bta_av_cfg.avrc_group should be TRUE */
#if AVRC_METADATA_INCLUDED == TRUE
#define BTA_AV_RC_SNK_SUPF_TG (AVRC_SUPF_TG_CAT2) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
@@ -105,6 +105,6 @@ const tBTA_AV_CFG bta_av_cfg = {
{0}, /* Default AVRCP target name */
};
tBTA_AV_CFG *p_bta_av_cfg = (tBTA_AV_CFG *) &bta_av_cfg;
const tBTA_AV_CFG *p_bta_av_cfg = &bta_av_cfg;
#endif /* if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE) */
components/bt/host/bluedroid/bta/av/bta_av_ci.c
+1 -1
View File
@@ -82,7 +82,7 @@ void bta_av_ci_setconfig(tBTA_AV_HNDL hndl, UINT8 err_code, UINT8 category,
p_buf->category = category;
p_buf->recfg_needed = recfg_needed;
p_buf->avdt_handle = avdt_handle;
p_buf->num_seid = num_seid;
p_buf->num_seid = (p_seid != NULL) ? num_seid : 0;
if (p_seid && num_seid) {
memcpy(p_buf->p_seid, p_seid, num_seid);
}
components/bt/host/bluedroid/bta/av/bta_av_main.c
+40 -23
View File
@@ -366,7 +366,12 @@ static tBTA_AV_SCB *bta_av_alloc_scb(tBTA_AV_CHNL chnl)
p_ret->hndl = (tBTA_AV_HNDL)((xx + 1) | chnl);
p_ret->hdi = xx;
p_ret->a2d_list = list_new(NULL);
bta_av_cb.p_scb[xx] = p_ret;
if (p_ret->a2d_list == NULL) {
osi_free(p_ret);
p_ret = NULL;
} else {
bta_av_cb.p_scb[xx] = p_ret;
}
}
break;
}
@@ -415,13 +420,15 @@ void bta_av_conn_cback(UINT8 handle, BD_ADDR bd_addr, UINT8 event, tAVDT_CTRL *p
p_scb = bta_av_addr_to_scb(bd_addr);
}
else if (AVDT_CONNECT_IND_EVT == event) {
APPL_TRACE_DEBUG("CONN_IND is ACP:%d\n", p_data->hdr.err_param);
if (p_data) {
APPL_TRACE_DEBUG("CONN_IND is ACP:%d\n", p_data->hdr.err_param);
}
}
if ((p_msg = (tBTA_AV_STR_MSG *) osi_malloc((UINT16) (sizeof(tBTA_AV_STR_MSG)))) != NULL) {
p_msg->hdr.event = evt;
p_msg->hdr.layer_specific = event;
p_msg->hdr.offset = p_data->hdr.err_param;
p_msg->hdr.offset = p_data ? p_data->hdr.err_param : 0;
bdcpy(p_msg->bd_addr, bd_addr);
if (p_scb) {
APPL_TRACE_DEBUG("scb hndl x%x, role x%x\n", p_scb->hndl, p_scb->role);
@@ -461,7 +468,7 @@ static void bta_av_a2dp_report_cback(UINT8 handle, AVDT_REPORT_TYPE type,
**
** Function bta_av_api_sink_enable
**
** Description activate, deactive A2DP Sink,
** Description activate, deactivate A2DP Sink,
**
** Returns void
**
@@ -528,7 +535,7 @@ static void bta_av_api_get_delay_value(tBTA_AV_DATA *p_data)
*******************************************************************************/
static void bta_av_api_register(tBTA_AV_DATA *p_data)
{
tBTA_AV_REGISTER registr;
tBTA_AV_REGISTER av_reg;
tBTA_AV_SCB *p_scb; /* stream control block */
tAVDT_REG reg;
tAVDT_CS cs;
@@ -542,28 +549,28 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
memset(&cs, 0, sizeof(tAVDT_CS));
registr.status = BTA_AV_FAIL_RESOURCES;
registr.app_id = p_data->api_reg.app_id;
registr.chnl = (tBTA_AV_CHNL)p_data->hdr.layer_specific;
registr.p_bta_av_cos = p_data->api_reg.bta_av_cos;
registr.p_bta_avrc_cos = p_data->api_reg.bta_avrc_cos;
av_reg.status = BTA_AV_FAIL_RESOURCES;
av_reg.app_id = p_data->api_reg.app_id;
av_reg.chnl = (tBTA_AV_CHNL)p_data->hdr.layer_specific;
av_reg.p_bta_av_cos = p_data->api_reg.bta_av_cos;
av_reg.p_bta_avrc_cos = p_data->api_reg.bta_avrc_cos;
// set the avrc call-out functions
bta_av_cb.p_rc_cos = p_data->api_reg.bta_avrc_cos;
do {
p_scb = bta_av_alloc_scb(registr.chnl);
p_scb = bta_av_alloc_scb(av_reg.chnl);
if (p_scb == NULL) {
APPL_TRACE_ERROR("failed to alloc SCB");
break;
}
registr.hndl = p_scb->hndl;
p_scb->app_id = registr.app_id;
av_reg.hndl = p_scb->hndl;
p_scb->app_id = av_reg.app_id;
/* initialize the stream control block */
p_scb->timer.p_cback = (TIMER_CBACK *)&bta_av_timer_cback;
registr.status = BTA_AV_SUCCESS;
av_reg.status = BTA_AV_SUCCESS;
if ((bta_av_cb.reg_audio + bta_av_cb.reg_video) == 0) {
/* the first channel registered. register to AVDTP */
@@ -593,7 +600,7 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
#endif
}
/* Set the Calss of Device (Audio & Capturing/Rendering service class bit) */
/* Set the Class of Device (Audio & Capturing/Rendering service class bit) */
if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
cod.service = BTM_COD_SERVICE_CAPTURING | BTM_COD_SERVICE_AUDIO;
cod.major = BTM_COD_MAJOR_AUDIO;
@@ -632,10 +639,10 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
p_scb->recfg_sup = TRUE;
cs.p_ctrl_cback = bta_av_dt_cback[p_scb->hdi];
if (registr.chnl == BTA_AV_CHNL_AUDIO) {
if (av_reg.chnl == BTA_AV_CHNL_AUDIO) {
/* set up the audio stream control block */
p_scb->p_act_tbl = (const tBTA_AV_ACT *)bta_av_a2d_action;
p_scb->p_cos = registr.p_bta_av_cos;
p_scb->p_cos = av_reg.p_bta_av_cos;
p_scb->media_type = AVDT_MEDIA_AUDIO;
cs.cfg.psc_mask = AVDT_PSC_TRANS;
cs.media_type = AVDT_MEDIA_AUDIO;
@@ -741,7 +748,7 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
} while (0);
/* call callback with register event */
(*bta_av_cb.p_cback)(BTA_AV_REGISTER_EVT, (tBTA_AV *)&registr);
(*bta_av_cb.p_cback)(BTA_AV_REGISTER_EVT, (tBTA_AV *)&av_reg);
}
/*******************************************************************************
@@ -1177,9 +1184,9 @@ void bta_av_dup_audio_buf(tBTA_AV_SCB *p_scb, BT_HDR *p_buf)
if (list_length(p_scbi->a2d_list) > p_bta_av_cfg->audio_mqs) {
// Drop the oldest packet
bta_av_co_audio_drop(p_scbi->hndl);
BT_HDR *p_buf = list_front(p_scbi->a2d_list);
list_remove(p_scbi->a2d_list, p_buf);
osi_free(p_buf);
BT_HDR *p_buf_drop = list_front(p_scbi->a2d_list);
list_remove(p_scbi->a2d_list, p_buf_drop);
osi_free(p_buf_drop);
}
}
}
@@ -1203,6 +1210,10 @@ void bta_av_sm_execute(tBTA_AV_CB *p_cb, UINT16 event, tBTA_AV_DATA *p_data)
tBTA_AV_ST_TBL state_table;
UINT8 action;
if (p_cb == NULL || p_cb->state >= (sizeof(bta_av_st_tbl) / sizeof(bta_av_st_tbl[0]))) {
return;
}
APPL_TRACE_EVENT("AV event=0x%x state=%d\n", event, p_cb->state);
/* look up the state table for the current state */
@@ -1210,6 +1221,10 @@ void bta_av_sm_execute(tBTA_AV_CB *p_cb, UINT16 event, tBTA_AV_DATA *p_data)
event &= 0x00FF;
if (event >= (sizeof(bta_av_st_init) / sizeof(bta_av_st_init[0]))) {
return;
}
/* set next state */
p_cb->state = state_table[event][BTA_AV_NEXT_STATE];
APPL_TRACE_EVENT("next state=%d\n", p_cb->state);
@@ -1242,8 +1257,10 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
if (event >= first_event) {
APPL_TRACE_VERBOSE("AV nsm event=0x%x(%s)\n", event, bta_av_evt_code(event));
/* non state machine events */
(*bta_av_nsm_act[event - BTA_AV_FIRST_NSM_EVT]) ((tBTA_AV_DATA *) p_msg);
if (event <= BTA_AV_LAST_NSM_EVT) {
/* non state machine events */
(*bta_av_nsm_act[event - BTA_AV_FIRST_NSM_EVT]) ((tBTA_AV_DATA *) p_msg);
}
} else if (event >= BTA_AV_FIRST_SM_EVT && event <= BTA_AV_LAST_SM_EVT) {
APPL_TRACE_VERBOSE("AV sm event=0x%x(%s)\n", event, bta_av_evt_code(event));
/* state machine events */
components/bt/host/bluedroid/bta/av/bta_av_sbc.c
+17 -10
View File
@@ -119,7 +119,9 @@ int bta_av_sbc_up_sample (void *p_src, void *p_dst,
dst = dst_samples / bta_av_sbc_ups_cb.div;
return (*bta_av_sbc_ups_cb.p_act)(p_src, p_dst, src, dst, p_ret);
} else {
*p_ret = 0;
if (p_ret) {
*p_ret = 0;
}
return 0;
}
}
@@ -212,7 +214,7 @@ int bta_av_sbc_up_sample_16m (void *p_src, void *p_dst,
UINT32 src_sps = bta_av_sbc_ups_cb.src_sps;
UINT32 dst_sps = bta_av_sbc_ups_cb.dst_sps;
while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples) {
while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples >= 2) {
*p_dst_tmp++ = *p_worker;
*p_dst_tmp++ = *p_worker;
@@ -224,7 +226,7 @@ int bta_av_sbc_up_sample_16m (void *p_src, void *p_dst,
bta_av_sbc_ups_cb.cur_pos = dst_sps;
while (src_samples-- && dst_samples) {
while (src_samples-- && dst_samples >= 2) {
*p_worker = *p_src_tmp++;
do {
@@ -235,7 +237,7 @@ int bta_av_sbc_up_sample_16m (void *p_src, void *p_dst,
dst_samples--;
dst_samples--;
} while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples);
} while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples >= 2);
bta_av_sbc_ups_cb.cur_pos += dst_sps;
}
@@ -276,7 +278,7 @@ int bta_av_sbc_up_sample_8s (void *p_src, void *p_dst,
UINT32 src_sps = bta_av_sbc_ups_cb.src_sps;
UINT32 dst_sps = bta_av_sbc_ups_cb.dst_sps;
while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples) {
while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples >= 2) {
*p_dst_tmp++ = *p_worker1;
*p_dst_tmp++ = *p_worker2;
@@ -287,7 +289,7 @@ int bta_av_sbc_up_sample_8s (void *p_src, void *p_dst,
bta_av_sbc_ups_cb.cur_pos = dst_sps;
while (src_samples -- && dst_samples) {
while (src_samples -- && dst_samples >= 2) {
*p_worker1 = *(UINT8 *)p_src_tmp++;
*p_worker1 -= 0x80;
*p_worker1 <<= 8;
@@ -302,7 +304,7 @@ int bta_av_sbc_up_sample_8s (void *p_src, void *p_dst,
bta_av_sbc_ups_cb.cur_pos -= src_sps;
dst_samples--;
dst_samples--;
} while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples);
} while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples >= 2);
bta_av_sbc_ups_cb.cur_pos += dst_sps;
}
@@ -342,7 +344,7 @@ int bta_av_sbc_up_sample_8m (void *p_src, void *p_dst,
UINT32 src_sps = bta_av_sbc_ups_cb.src_sps;
UINT32 dst_sps = bta_av_sbc_ups_cb.dst_sps;
while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples) {
while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples >= 4) {
*p_dst_tmp++ = *p_worker;
*p_dst_tmp++ = *p_worker;
@@ -353,7 +355,7 @@ int bta_av_sbc_up_sample_8m (void *p_src, void *p_dst,
bta_av_sbc_ups_cb.cur_pos = dst_sps;
while (src_samples-- && dst_samples) {
while (src_samples-- && dst_samples >= 4) {
*p_worker = *(UINT8 *)p_src_tmp++;
*p_worker -= 0x80;
*p_worker <<= 8;
@@ -365,7 +367,7 @@ int bta_av_sbc_up_sample_8m (void *p_src, void *p_dst,
bta_av_sbc_ups_cb.cur_pos -= src_sps;
dst_samples -= 4;
} while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples);
} while (bta_av_sbc_ups_cb.cur_pos > 0 && dst_samples >= 4);
bta_av_sbc_ups_cb.cur_pos += dst_sps;
}
@@ -455,6 +457,11 @@ UINT8 bta_av_sbc_cfg_for_cap(UINT8 *p_peer, tA2D_SBC_CIE *p_cap, tA2D_SBC_CIE *p
peer_cie.min_bitpool = p_pref->min_bitpool;
}
if (peer_cie.min_bitpool > peer_cie.max_bitpool) {
APPL_TRACE_ERROR("bta_av_sbc_cfg_for_cap: min_bp > max_bp");
return A2D_FAIL;
}
if (status == A2D_SUCCESS) {
/* build configuration */
A2D_BldSbcInfo(A2D_MEDIA_TYPE_AUDIO, &peer_cie, p_peer);
components/bt/host/bluedroid/bta/av/bta_av_ssm.c
+5
View File
@@ -429,6 +429,11 @@ void bta_av_ssm_execute(tBTA_AV_SCB *p_scb, UINT16 event, tBTA_AV_DATA *p_data)
APPL_TRACE_VERBOSE("AV Sevent(0x%x)=0x%x(%s) state=%d(%s)",
p_scb->hndl, event, bta_av_evt_code(event), p_scb->state, bta_av_sst_code(p_scb->state));
if (p_scb->state >= (sizeof(bta_av_sst_tbl) / sizeof(bta_av_sst_tbl[0])) ||
event < BTA_AV_FIRST_SSM_EVT || event > BTA_AV_LAST_SSM_EVT) {
return;
}
/* look up the state table for the current state */
state_table = bta_av_sst_tbl[p_scb->state];
components/bt/host/bluedroid/bta/av/include/bta_av_int.h
+2 -1
View File
@@ -117,6 +117,7 @@ enum {
/* events for AV stream control block state machine */
#define BTA_AV_FIRST_SSM_EVT BTA_AV_API_OPEN_EVT
#define BTA_AV_LAST_SSM_EVT BTA_AV_ACP_CONNECT_EVT
/* events that do not go through state machine */
#define BTA_AV_FIRST_NSM_EVT BTA_AV_API_ENABLE_EVT
@@ -583,7 +584,7 @@ extern tBTA_AV_CB *bta_av_cb_ptr;
#endif
/* config struct */
extern tBTA_AV_CFG *p_bta_av_cfg;
extern const tBTA_AV_CFG *p_bta_av_cfg;
extern const tBTA_AV_SACT bta_av_a2d_action[];
extern const tBTA_AV_SACT bta_av_vdp_action[];