Commit: 8d930b9143c201787699beb7be0b47fd66699db7 - system-bt (git)

system/bt

Commit MetaInfo

• Révision: 8d930b9143c201787699beb7be0b47fd66699db7 (tree)
• l'heure: 2020-03-16 19:40:40
• Auteur: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Message de Log

Android 8.1.0 release 74
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXl1rEAAKCRDorT+BmrEO
eLxvAJ9ujZEpIPtet+3JnxDojMQ7nqiVDwCdGgo6yyOaaSb2niJMkybWw99Ze4M=
=VLUH
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r74' into oreo-x86

Android 8.1.0 release 74

Change Summary

• modified: btcore/src/device_class.cc
• modified: btcore/test/device_class_test.cc
• modified: btif/include/btif_dm.h
• modified: btif/src/btif_dm.cc
• modified: hci/src/packet_fragmenter.cc
• modified: service/low_energy_client.cc
• modified: stack/btm/btm_acl.cc
• modified: stack/btm/btm_int.h
• modified: stack/btu/btu_hcif.cc
• modified: stack/include/hcidefs.h
• modified: stack/sdp/sdp_discovery.cc

Modification

--- a/btcore/src/device_class.cc
+++ b/btcore/src/device_class.cc
@@ -87,7 +87,9 @@ void device_class_from_int(bt_device_class_t* dc, int data) {
 int device_class_to_int(const bt_device_class_t* dc) {
   CHECK(dc != NULL);
   // Careful with endianess.
-  return (int)(le32toh(*(int*)dc) & 0xffffff);
+  int val = 0;
+  memcpy(&val, dc, sizeof(*dc));
+  return static_cast<int>(le32toh(val) & 0xffffff);
 }
 
 bool device_class_equals(const bt_device_class_t* p1,

--- a/btcore/test/device_class_test.cc
+++ b/btcore/test/device_class_test.cc
@@ -22,9 +22,6 @@
 
 #include "btcore/include/device_class.h"
 
-// Device Class is 3 bytes.
-static const int DC_MASK = 0xffffff;
-
 ::testing::AssertionResult check_bitfield(const char* m_expr,
                                           const char* n_expr, int m, int n) {
   if (m == n) return ::testing::AssertionSuccess();
@@ -84,8 +81,9 @@ TEST_F(DeviceClassTest, to_stream) {
     int rc = device_class_to_stream(&dc, dc_stream1, sizeof(dc_stream1));
     EXPECT_EQ(3, rc);
 
-    uint32_t* val = (uint32_t*)&dc;
-    EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, *val & 0xffffff);
+    uint32_t val = 0;
+    memcpy(&val, &dc, sizeof(dc));
+    EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, val);
 
     EXPECT_PRED_FORMAT2(check_bitfield, 0x00, dc_stream1[0]);
     EXPECT_PRED_FORMAT2(check_bitfield, 0x00, dc_stream1[1]);
@@ -101,8 +99,9 @@ TEST_F(DeviceClassTest, to_stream) {
 
     int rc = device_class_to_stream(&dc, dc_stream1, sizeof(dc_stream1));
     EXPECT_EQ(3, rc);
-    uint32_t* val = (uint32_t*)&dc;
-    EXPECT_PRED_FORMAT2(check_bitfield, 0x00aa55aa, *val & 0xffffff);
+    uint32_t val = 0;
+    memcpy(&val, &dc, sizeof(dc));
+    EXPECT_PRED_FORMAT2(check_bitfield, 0x00aa55aa, val);
 
     EXPECT_PRED_FORMAT2(check_bitfield, 0xaa, dc_stream1[0]);
     EXPECT_PRED_FORMAT2(check_bitfield, 0x55, dc_stream1[1]);
@@ -118,8 +117,9 @@ TEST_F(DeviceClassTest, to_stream) {
 
     int rc = device_class_to_stream(&dc, dc_stream1, sizeof(dc_stream1));
     EXPECT_EQ(3, rc);
-    uint32_t* val = (uint32_t*)&dc;
-    EXPECT_PRED_FORMAT2(check_bitfield, 0x452301, *val & 0xffffff);
+    uint32_t val = 0;
+    memcpy(&val, &dc, sizeof(dc));
+    EXPECT_PRED_FORMAT2(check_bitfield, 0x452301, val);
 
     EXPECT_PRED_FORMAT2(check_bitfield, 0x01, dc_stream1[0]);
     EXPECT_PRED_FORMAT2(check_bitfield, 0x23, dc_stream1[1]);
@@ -131,24 +131,33 @@ TEST_F(DeviceClassTest, limited_discoverable_mode) {
   uint8_t dc_stream[] = {0x00, 0x00, 0x00};
   bt_device_class_t dc;
   device_class_from_stream(&dc, dc_stream);
-  uint32_t* test = (uint32_t*)&dc;
+  uint32_t test = 0;
+  memcpy(&test, &dc, sizeof(dc));
 
   EXPECT_FALSE(device_class_get_limited(&dc));
-  EXPECT_EQ((unsigned)0x00000000, *test & DC_MASK);
+  EXPECT_EQ((unsigned)0x00000000, test);
 
   device_class_set_limited(&dc, true);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
   EXPECT_TRUE(device_class_get_limited(&dc));
-  EXPECT_EQ((unsigned)0x00002000, *test & DC_MASK);
+  EXPECT_EQ((unsigned)0x00002000, test);
 
   device_class_set_limited(&dc, false);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
   EXPECT_FALSE(device_class_get_limited(&dc));
-  EXPECT_EQ((unsigned)0x00000000, *test & DC_MASK);
+  EXPECT_EQ((unsigned)0x00000000, test);
 
   device_class_set_limited(&dc, true);
-  EXPECT_PRED_FORMAT2(check_bitfield, 0x00002000, *test & DC_MASK);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
+  EXPECT_PRED_FORMAT2(check_bitfield, 0x00002000, test);
 
   device_class_set_limited(&dc, false);
-  EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, *test & DC_MASK);
+  test = 0;
+  memcpy(&test, &dc, sizeof(dc));
+  EXPECT_PRED_FORMAT2(check_bitfield, 0x00000000, test);
 }
 
 TEST_F(DeviceClassTest, equals) {

--- a/btif/include/btif_dm.h
+++ b/btif/include/btif_dm.h
@@ -100,7 +100,7 @@ void btif_dm_load_ble_local_keys(void);
 void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
                                 BT_OCTET16 er,
                                 tBTA_BLE_LOCAL_ID_KEYS* p_id_keys);
-void btif_dm_save_ble_bonding_keys(void);
+void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr);
 void btif_dm_remove_ble_bonding_keys(void);
 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ* p_ble_req);
 

--- a/btif/src/btif_dm.cc
+++ b/btif/src/btif_dm.cc
@@ -183,6 +183,7 @@ typedef struct {
 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id))
 
 #define UUID_HUMAN_INTERFACE_DEVICE "00001124-0000-1000-8000-00805f9b34fb"
+#define UUID_EMPTY "00000000-0000-0000-0000-000000000000"
 
 #define MAX_BTIF_BOND_EVENT_ENTRIES 15
 
@@ -261,6 +262,11 @@ static bool is_empty_128bit(uint8_t* data) {
   return !memcmp(zero, data, sizeof(zero));
 }
 
+static bool is_bonding_or_sdp() {
+  return pairing_cb.state == BT_BOND_STATE_BONDING ||
+         (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts);
+}
+
 static void btif_dm_data_copy(uint16_t event, char* dst, char* src) {
   tBTA_DM_SEC* dst_dm_sec = (tBTA_DM_SEC*)dst;
   tBTA_DM_SEC* src_dm_sec = (tBTA_DM_SEC*)src;
@@ -487,8 +493,6 @@ static void bond_state_changed(bt_status_t status, const RawAddress& bd_addr,
                                bt_bond_state_t state) {
   btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_BOND_STATE_CHANGED, state);
 
-  // Send bonding state only once - based on outgoing/incoming we may receive
-  // duplicates
   if ((pairing_cb.state == state) && (state == BT_BOND_STATE_BONDING)) {
     // Cross key pairing so send callback for static address
     if (!pairing_cb.static_bdaddr.IsEmpty()) {
@@ -506,14 +510,13 @@ static void bond_state_changed(bt_status_t status, const RawAddress& bd_addr,
   auto tmp = bd_addr;
   HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
 
-  if (state == BT_BOND_STATE_BONDING) {
+  if (state == BT_BOND_STATE_BONDING ||
+      (state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts > 0)) {
+    // Save state for the device is bonding or SDP.
     pairing_cb.state = state;
     pairing_cb.bd_addr = bd_addr;
   } else {
-    if (!pairing_cb.sdp_attempts)
-      memset(&pairing_cb, 0, sizeof(pairing_cb));
-    else
-      BTIF_TRACE_DEBUG("%s: BR-EDR service discovery active", __func__);
+    pairing_cb = {};
   }
 }
 
@@ -947,21 +950,12 @@ static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ* p_ssp_cfm_req) {
 
   /* If JustWorks auto-accept */
   if (p_ssp_cfm_req->just_works) {
-    /* Pairing consent for JustWorks needed if:
-     * 1. Incoming (non-temporary) pairing is detected AND
-     * 2. local IO capabilities are DisplayYesNo AND
-     * 3. remote IO capabiltiies are DisplayOnly or NoInputNoOutput;
+    /* Pairing consent for JustWorks NOT needed if:
+     * 1. Incoming temporary pairing is detected
      */
-    if (is_incoming && pairing_cb.bond_type != BOND_TYPE_TEMPORARY &&
-        ((p_ssp_cfm_req->loc_io_caps == HCI_IO_CAP_DISPLAY_YESNO) &&
-         (p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_DISPLAY_ONLY ||
-          p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_NO_IO))) {
+    if (is_incoming && pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
       BTIF_TRACE_EVENT(
-          "%s: User consent needed for incoming pairing request. loc_io_caps: "
-          "%d, rmt_io_caps: %d",
-          __func__, p_ssp_cfm_req->loc_io_caps, p_ssp_cfm_req->rmt_io_caps);
-    } else {
-      BTIF_TRACE_EVENT("%s: Auto-accept JustWorks pairing", __func__);
+          "%s: Auto-accept JustWorks pairing for temporary incoming", __func__);
       btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, true, 0);
       return;
     }
@@ -1121,6 +1115,17 @@ static void btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
 
         /* Trigger SDP on the device */
         pairing_cb.sdp_attempts = 1;
+
+        if (is_crosskey) {
+          // If bonding occurred due to cross-key pairing, send bonding callback
+          // for static address now
+          LOG_INFO(LOG_TAG,
+                   "%s: send bonding state update for static address %s",
+                   __func__, bd_addr.ToString().c_str());
+          bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
+        }
+        bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
+
         btif_dm_get_remote_services(bd_addr);
       }
     }
@@ -1378,9 +1383,9 @@ static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
 
       BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
                        p_data->disc_res.result, p_data->disc_res.services);
-      if ((p_data->disc_res.result != BTA_SUCCESS) &&
-          (pairing_cb.state == BT_BOND_STATE_BONDING) &&
-          (pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING)) {
+      if (p_data->disc_res.result != BTA_SUCCESS &&
+          pairing_cb.state == BT_BOND_STATE_BONDED &&
+          pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING) {
         BTIF_TRACE_WARNING("%s:SDP failed after bonding re-attempting",
                            __func__);
         pairing_cb.sdp_attempts++;
@@ -1405,21 +1410,38 @@ static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
       /* onUuidChanged requires getBondedDevices to be populated.
       ** bond_state_changed needs to be sent prior to remote_device_property
       */
-      if ((pairing_cb.state == BT_BOND_STATE_BONDING) &&
+      if ((pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts) &&
           (p_data->disc_res.bd_addr == pairing_cb.bd_addr ||
-           p_data->disc_res.bd_addr == pairing_cb.static_bdaddr) &&
-          pairing_cb.sdp_attempts > 0) {
-        BTIF_TRACE_DEBUG(
-            "%s Remote Service SDP done. Call bond_state_changed_cb BONDED",
-            __func__);
+           p_data->disc_res.bd_addr == pairing_cb.static_bdaddr)) {
+        LOG_INFO(LOG_TAG, "%s: SDP search done for %s", __func__,
+                 bd_addr.ToString().c_str());
         pairing_cb.sdp_attempts = 0;
 
-        // If bonding occured due to cross-key pairing, send bonding callback
-        // for static address now
-        if (p_data->disc_res.bd_addr == pairing_cb.static_bdaddr)
-          bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
-
-        bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
+        // Both SDP and bonding are done, clear pairing control block
+        pairing_cb = {};
+
+        // Send one empty UUID to Java to unblock pairing intent when SDP failed
+        // or no UUID is discovered
+        if (p_data->disc_res.result != BTA_SUCCESS ||
+            p_data->disc_res.num_uuids == 0) {
+          LOG_INFO(LOG_TAG,
+                   "%s: SDP failed, send empty UUID to unblock bonding %s",
+                   __func__, bd_addr.ToString().c_str());
+          bt_property_t prop;
+          bt_uuid_t uuid = {};
+          char uuid_str[128] = UUID_EMPTY;
+
+          string_to_uuid(uuid_str, &uuid);
+
+          prop.type = BT_PROPERTY_UUIDS;
+          prop.val = uuid.uu;
+          prop.len = MAX_UUID_SIZE;
+
+          /* Send the event to the BTIF */
+          HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
+                    BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
+          break;
+        }
       }
 
       if (p_data->disc_res.num_uuids != 0) {
@@ -1629,7 +1651,7 @@ static void btif_dm_upstreams_evt(uint16_t event, char* p_param) {
       break;
 
     case BTA_DM_BOND_CANCEL_CMPL_EVT:
-      if (pairing_cb.state == BT_BOND_STATE_BONDING) {
+      if (is_bonding_or_sdp()) {
         bd_addr = pairing_cb.bd_addr;
         btm_set_bond_type_dev(pairing_cb.bd_addr, BOND_TYPE_UNKNOWN);
         bond_state_changed((bt_status_t)p_data->bond_cancel_cmpl.result,
@@ -2277,7 +2299,7 @@ bt_status_t btif_dm_cancel_bond(const RawAddress* bd_addr) {
   **  1. Restore scan modes
   **  2. special handling for HID devices
   */
-  if (pairing_cb.state == BT_BOND_STATE_BONDING) {
+  if (is_bonding_or_sdp()) {
     if (pairing_cb.is_ssp) {
       if (pairing_cb.is_le_only) {
         BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
@@ -2469,7 +2491,7 @@ bt_status_t btif_dm_get_remote_services(const RawAddress& remote_addr) {
 
 /*******************************************************************************
  *
- * Function         btif_dm_get_remote_services_transport
+ * Function         btif_dm_get_remote_services_by_transport
  *
  * Description      Start SDP to get remote services by transport
  *
@@ -2838,7 +2860,7 @@ static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
       btif_storage_remove_bonded_device(&bdaddr);
       state = BT_BOND_STATE_NONE;
     } else {
-      btif_dm_save_ble_bonding_keys();
+      btif_dm_save_ble_bonding_keys(bdaddr);
       BTA_GATTC_Refresh(bd_addr);
       btif_dm_get_remote_services_by_transport(&bd_addr, BTA_GATT_TRANSPORT_LE);
     }
@@ -2861,6 +2883,10 @@ static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
         break;
     }
   }
+  if (state == BT_BOND_STATE_BONDED && bd_addr != pairing_cb.static_bdaddr) {
+    // Report RPA bonding state to Java in crosskey paring
+    bond_state_changed(status, bd_addr, BT_BOND_STATE_BONDING);
+  }
   bond_state_changed(status, bd_addr, state);
 }
 
@@ -2907,11 +2933,9 @@ void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
   BTIF_TRACE_DEBUG("%s  *p_key_mask=0x%02x", __func__, *p_key_mask);
 }
 
-void btif_dm_save_ble_bonding_keys(void) {
+void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr) {
   BTIF_TRACE_DEBUG("%s", __func__);
 
-  RawAddress bd_addr = pairing_cb.bd_addr;
-
   if (pairing_cb.ble.is_penc_key_rcvd) {
     btif_storage_add_ble_bonding_key(&bd_addr, (char*)&pairing_cb.ble.penc_key,
                                      BTIF_DM_LE_KEY_PENC,
@@ -3171,7 +3195,7 @@ bt_status_t btif_le_test_mode(uint16_t opcode, uint8_t* buf, uint8_t len) {
 
 void btif_dm_on_disable() {
   /* cancel any pending pairing requests */
-  if (pairing_cb.state == BT_BOND_STATE_BONDING) {
+  if (is_bonding_or_sdp()) {
     BTIF_TRACE_DEBUG("%s: Cancel pending pairing request", __func__);
     btif_dm_cancel_bond(&pairing_cb.bd_addr);
   }

--- a/hci/src/packet_fragmenter.cc
+++ b/hci/src/packet_fragmenter.cc
@@ -212,7 +212,8 @@ static void reassemble_and_dispatch(UNUSED_ATTR BT_HDR* packet) {
                  "%s got packet which would exceed expected length of %d. "
                  "Truncating.",
                  __func__, partial_packet->len);
-        packet->len = partial_packet->len - partial_packet->offset;
+        packet->len =
+            (partial_packet->len - partial_packet->offset) + packet->offset;
         projected_offset = partial_packet->len;
       }
 

--- a/service/low_energy_client.cc
+++ b/service/low_energy_client.cc
@@ -188,8 +188,8 @@ void LowEnergyClient::MtuChangedCallback(
 
   if (!bda) return;
 
-  const char* addr = BtAddrString(bda).c_str();
-  if (delegate_) delegate_->OnMtuChanged(this, status, addr, mtu);
+  std::string addr = BtAddrString(bda);
+  if (delegate_) delegate_->OnMtuChanged(this, status, addr.c_str(), mtu);
 }
 
 // LowEnergyClientFactory implementation

--- a/stack/btm/btm_acl.cc
+++ b/stack/btm/btm_acl.cc
@@ -47,6 +47,7 @@
 #include "device/include/interop.h"
 #include "hcidefs.h"
 #include "hcimsgs.h"
+#include "log/log.h"
 #include "l2c_int.h"
 #include "osi/include/osi.h"
 
@@ -1062,7 +1063,7 @@ void btm_read_remote_features_complete(uint8_t* p) {
  * Returns          void
  *
  ******************************************************************************/
-void btm_read_remote_ext_features_complete(uint8_t* p) {
+void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
   tACL_CONN* p_acl_cb;
   uint8_t page_num, max_page;
   uint16_t handle;
@@ -1070,6 +1071,14 @@ void btm_read_remote_ext_features_complete(uint8_t* p) {
 
   BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
 
+  if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
+    android_errorWriteLog(0x534e4554, "141552859");
+    BTM_TRACE_ERROR(
+        "btm_read_remote_ext_features_complete evt length too short. length=%d",
+        evt_len);
+    return;
+  }
+
   ++p;
   STREAM_TO_UINT16(handle, p);
   STREAM_TO_UINT8(page_num, p);
@@ -1089,6 +1098,19 @@ void btm_read_remote_ext_features_complete(uint8_t* p) {
     return;
   }
 
+  if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
+    android_errorWriteLog(0x534e4554, "141552859");
+    BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
+                    page_num);
+    return;
+  }
+
+  if (page_num > max_page) {
+    BTM_TRACE_WARNING(
+        "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
+        "invalid", page_num, max_page);
+  }
+
   p_acl_cb = &btm_cb.acl_db[acl_idx];
 
   /* Copy the received features page */

--- a/stack/btm/btm_int.h
+++ b/stack/btm/btm_int.h
@@ -117,7 +117,7 @@ extern uint16_t btm_get_acl_disc_reason_code(void);
 extern tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr,
                                   tBT_TRANSPORT transport);
 extern void btm_read_remote_features_complete(uint8_t* p);
-extern void btm_read_remote_ext_features_complete(uint8_t* p);
+extern void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len);
 extern void btm_read_remote_ext_features_failed(uint8_t status,
                                                 uint16_t handle);
 extern void btm_read_remote_version_complete(uint8_t* p);

--- a/stack/btu/btu_hcif.cc
+++ b/stack/btu/btu_hcif.cc
@@ -70,7 +70,8 @@ static void btu_hcif_authentication_comp_evt(uint8_t* p);
 static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len);
 static void btu_hcif_encryption_change_evt(uint8_t* p);
 static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p);
-static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p);
+static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
+                                                    uint8_t evt_len);
 static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p);
 static void btu_hcif_qos_setup_comp_evt(uint8_t* p);
 static void btu_hcif_command_complete_evt(BT_HDR* response, void* context);
@@ -194,7 +195,7 @@ void btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_msg) {
       btu_hcif_read_rmt_features_comp_evt(p);
       break;
     case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:
-      btu_hcif_read_rmt_ext_features_comp_evt(p);
+      btu_hcif_read_rmt_ext_features_comp_evt(p, hci_evt_len);
       break;
     case HCI_READ_RMT_VERSION_COMP_EVT:
       btu_hcif_read_rmt_version_comp_evt(p);
@@ -791,7 +792,8 @@ static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p) {
  * Returns          void
  *
  ******************************************************************************/
-static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {
+static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
+                                                    uint8_t evt_len) {
   uint8_t* p_cur = p;
   uint8_t status;
   uint16_t handle;
@@ -799,7 +801,7 @@ static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {
   STREAM_TO_UINT8(status, p_cur);
 
   if (status == HCI_SUCCESS)
-    btm_read_remote_ext_features_complete(p);
+    btm_read_remote_ext_features_complete(p, evt_len);
   else {
     STREAM_TO_UINT16(handle, p_cur);
     btm_read_remote_ext_features_failed(status, handle);

--- a/stack/include/hcidefs.h
+++ b/stack/include/hcidefs.h
@@ -1296,6 +1296,8 @@ typedef struct {
 
 #define HCI_FEATURE_BYTES_PER_PAGE 8
 
+#define HCI_EXT_FEATURES_SUCCESS_EVT_LEN 13
+
 #define HCI_FEATURES_KNOWN(x) \
   (((x)[0] | (x)[1] | (x)[2] | (x)[3] | (x)[4] | (x)[5] | (x)[6] | (x)[7]) != 0)
 

--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -338,11 +338,13 @@ static void process_service_search_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
  * Description      copy the raw data
  *
  *
- * Returns          void
+ * Returns          bool
+ *                          true if successful
+ *                          false if not copied
  *
  ******************************************************************************/
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
-static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
+static bool sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
   unsigned int cpy_len, rem_len;
   uint32_t list_len;
   uint8_t* p;
@@ -373,11 +375,11 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
       p = sdpu_get_len_from_type(p, p_end, type, &list_len);
       if (p == NULL || (p + list_len) > p_end) {
         SDP_TRACE_WARNING("%s: bad length", __func__);
-        return;
+        return false;
       }
       if ((int)cpy_len < (p - old_p)) {
         SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
-        return;
+        return false;
       }
       cpy_len -= (p - old_p);
     }
@@ -397,6 +399,7 @@ static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
     memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
     p_ccb->p_db->raw_used += cpy_len;
   }
+  return true;
 }
 #endif
 
@@ -465,7 +468,12 @@ static void process_service_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
     } else {
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
       SDP_TRACE_WARNING("process_service_attr_rsp");
-      sdp_copy_raw_data(p_ccb, false);
+      if (!sdp_copy_raw_data(p_ccb, false)) {
+        SDP_TRACE_ERROR("sdp_copy_raw_data failed");
+        sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
+        return;
+      }
+
 #endif
 
       /* Save the response in the database. Stop on any error */
@@ -690,7 +698,11 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
 
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
   SDP_TRACE_WARNING("process_service_search_attr_rsp");
-  sdp_copy_raw_data(p_ccb, true);
+  if (!sdp_copy_raw_data(p_ccb, true)) {
+    SDP_TRACE_ERROR("sdp_copy_raw_data failed");
+    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
+    return;
+  }
 #endif
 
   p = &p_ccb->rsp_list[0];
@@ -705,6 +717,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply,
   p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
   if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
     SDP_TRACE_WARNING("%s: bad length", __func__);
+    sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
     return;
   }
   p_end = &p_ccb->rsp_list[p_ccb->list_len];