Fix changes from September 2017 ASB

- fix formatting difference and use official 6.0.1 patches from r81
  (e.g. commit 33427d54f31adaf5b9c697f5ce642fda1dc01946 and
  commit 7f17ba1f8e475706727df7c50bc31ffb191d1f9d don't match googles patches
  for 6.0.1)

Change-Id: I3187d1be2bcbc896a60100eda7c42d0e7bb5131f

6 files changed, 58 insertions, 68 deletions

diff --git a/bta/pan/bta_pan_act.c b/bta/pan/bta_pan_act.c
index bb502db95..f4b95d908 100644
--- a/bta/pan/bta_pan_act.c
+++ b/bta/pan/bta_pan_act.c
@@ -231,15 +231,16 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
 
     if ( sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset )
     {
-        /* offset smaller than data structure in front of actual data */
         if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
-            PAN_BUF_SIZE) {
-          android_errorWriteLog(0x534e4554, "63146237");
-          APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
-                           p_buf->len);
-          GKI_freebuf(p_buf);
-          return;
+            GKI_get_pool_bufsize(PAN_POOL_ID)) {
+            android_errorWriteLog(0x534e4554, "63146237");
+            APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
+                             p_buf->len);
+            GKI_freebuf(p_buf);
+            return;
         }
+
+        /* offset smaller than data structure in front of actual data */
         p_new_buf = (BT_HDR *)GKI_getpoolbuf( PAN_POOL_ID );
         if(!p_new_buf)
         {
diff --git a/include/bt_target.h b/include/bt_target.h
index e5e6280b5..6e9a835c6 100644
--- a/include/bt_target.h
+++ b/include/bt_target.h
@@ -334,10 +334,6 @@
 #define AVDT_DATA_POOL_SIZE         GKI_BUF3_SIZE
 #endif
 
-#ifndef PAN_BUF_SIZE
-#define PAN_BUF_SIZE                GKI_BUF3_SIZE
-#endif
-
 #ifndef PAN_POOL_ID
 #define PAN_POOL_ID                 GKI_POOL_ID_3
 /* Maximum amount of the shared buffer to allocate for PAN */
diff --git a/stack/bnep/bnep_main.c b/stack/bnep/bnep_main.c
index 71711c688..a20e1cf5e 100644
--- a/stack/bnep/bnep_main.c
+++ b/stack/bnep/bnep_main.c
@@ -565,7 +565,8 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
             p_bcb->con_state != BNEP_STATE_CONNECTED &&
             extension_present && p && rem_len)
         {
-            GKI_freebuf(p_bcb->p_pending_data);
+            if (p_bcb->p_pending_data)
+                GKI_freebuf (p_bcb->p_pending_data);
             p_bcb->p_pending_data = (BT_HDR *)GKI_getbuf (rem_len + sizeof(BT_HDR));
             if (p_bcb->p_pending_data)
             {
diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c
index a9987cf8b..a0af6877a 100644
--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -150,7 +150,8 @@ void bnepu_release_bcb (tBNEP_CONN *p_bcb)
 
     /* Drop any response pointer we may be holding */
     p_bcb->con_state        = BNEP_STATE_IDLE;
-    GKI_freebuf(p_bcb->p_pending_data);
+    if (p_bcb->p_pending_data)
+        GKI_freebuf (p_bcb->p_pending_data);
     p_bcb->p_pending_data   = NULL;
 
     /* Free transmit queue */
@@ -787,14 +788,13 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
     UINT8       control_type;
     UINT16      len, ext_len = 0;
 
-    if (p == NULL || rem_len == NULL)
-    {
+    if (p == NULL || rem_len == NULL) {
         if (rem_len != NULL) *rem_len = 0;
         BNEP_TRACE_DEBUG("%s: invalid packet: p = %p rem_len = %p", __func__, p,
                          rem_len);
         return NULL;
     }
-    uint16_t rem_len_orig = *rem_len;
+    UINT16 rem_len_orig = *rem_len;
 
     if (is_ext)
     {
@@ -807,34 +807,31 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
     control_type = *p++;
     *rem_len = *rem_len - 1;
 
-    BNEP_TRACE_EVENT(
-        "%s: BNEP processing control packet rem_len %d, is_ext %d, ctrl_type %d",
-        __func__, *rem_len, is_ext, control_type);
+    BNEP_TRACE_EVENT("%s: BNEP processing control packet rem_len %d, is_ext %d, ctrl_type %d",
+                     __func__, *rem_len, is_ext, control_type);
 
     switch (control_type)
     {
     case BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD:
-        if (*rem_len < 1)
-        {
+        if (*rem_len < 1) {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD with bad length",
-                __func__);
+              "%s: Received BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD with bad length",
+              __func__);
             goto bad_packet_length;
         }
         BNEP_TRACE_ERROR(
-              "%s: Received BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD for pkt type: %d",
-              __func__, *p);
+          "%s: Received BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD for pkt type: %d",
+          __func__, *p);
         p++;
         *rem_len = *rem_len - 1;
         break;
 
     case BNEP_SETUP_CONNECTION_REQUEST_MSG:
         len = *p++;
-        if (*rem_len < ((2 * len) + 1))
-        {
+        if (*rem_len < ((2 * len) + 1)) {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_SETUP_CONNECTION_REQUEST_MSG with bad length",
-                __func__);
+              "%s: Received BNEP_SETUP_CONNECTION_REQUEST_MSG with bad length",
+              __func__);
             goto bad_packet_length;
         }
         if (!is_ext)
@@ -844,11 +841,10 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         break;
 
     case BNEP_SETUP_CONNECTION_RESPONSE_MSG:
-        if (*rem_len < 2)
-        {
+        if (*rem_len < 2) {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_SETUP_CONNECTION_RESPONSE_MSG with bad length",
-                __func__);
+              "%s: Received BNEP_SETUP_CONNECTION_RESPONSE_MSG with bad length",
+              __func__);
             goto bad_packet_length;
         }
         if (!is_ext)
@@ -862,8 +858,8 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         if (*rem_len < (len + 2))
         {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_FILTER_NET_TYPE_SET_MSG with bad length",
-                __func__);
+              "%s: Received BNEP_FILTER_NET_TYPE_SET_MSG with bad length",
+              __func__);
             goto bad_packet_length;
         }
         bnepu_process_peer_filter_set (p_bcb, p, len);
@@ -872,11 +868,10 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         break;
 
     case BNEP_FILTER_NET_TYPE_RESPONSE_MSG:
-        if (*rem_len < 2)
-        {
+        if (*rem_len < 2) {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_FILTER_NET_TYPE_RESPONSE_MSG with bad length",
-                __func__);
+              "%s: Received BNEP_FILTER_NET_TYPE_RESPONSE_MSG with bad length",
+              __func__);
             goto bad_packet_length;
         }
         bnepu_process_peer_filter_rsp (p_bcb, p);
@@ -889,8 +884,8 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         if (*rem_len < (len + 2))
         {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_FILTER_MULTI_ADDR_SET_MSG with bad length",
-                __func__);
+              "%s: Received BNEP_FILTER_MULTI_ADDR_SET_MSG with bad length",
+              __func__);
             goto bad_packet_length;
         }
         bnepu_process_peer_multicast_filter_set (p_bcb, p, len);
@@ -899,11 +894,10 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         break;
 
     case BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG:
-        if (*rem_len < 2)
-        {
+        if (*rem_len < 2) {
             BNEP_TRACE_ERROR(
-                "%s: Received BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG with bad length",
-                __func__);
+              "%s: Received BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG with bad length",
+              __func__);
             goto bad_packet_length;
         }
         bnepu_process_multicast_filter_rsp (p_bcb, p);
@@ -917,8 +911,7 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len
         bnep_send_command_not_understood (p_bcb, control_type);
         if (is_ext && (ext_len > 0))
         {
-            if (*rem_len < (ext_len - 1))
-            {
+            if (*rem_len < (ext_len - 1)) {
                 goto bad_packet_length;
             }
             p += (ext_len - 1);
diff --git a/stack/l2cap/l2cap_client.c b/stack/l2cap/l2cap_client.c
index e4c7d82f6..8e19c1e43 100644
--- a/stack/l2cap/l2cap_client.c
+++ b/stack/l2cap/l2cap_client.c
@@ -372,7 +372,8 @@ static void fragment_packet(l2cap_client_t *client, buffer_t *packet) {
   assert(packet != NULL);
 
   // TODO(sharvil): eliminate copy into BT_HDR.
-  BT_HDR *bt_packet = GKI_getbuf(buffer_length(packet) + L2CAP_MIN_OFFSET + sizeof(BT_HDR));
+  BT_HDR *bt_packet = GKI_getbuf(buffer_length(packet) + L2CAP_MIN_OFFSET +
+                                 sizeof(BT_HDR));
   bt_packet->offset = L2CAP_MIN_OFFSET;
   bt_packet->len = buffer_length(packet);
   memcpy(bt_packet->data + bt_packet->offset, buffer_ptr(packet), buffer_length(packet));
@@ -386,7 +387,8 @@ static void fragment_packet(l2cap_client_t *client, buffer_t *packet) {
       break;
     }
 
-    BT_HDR *fragment = GKI_getbuf(client->remote_mtu + L2CAP_MIN_OFFSET + sizeof(BT_HDR));
+    BT_HDR *fragment = GKI_getbuf(client->remote_mtu + L2CAP_MIN_OFFSET +
+                                  sizeof(BT_HDR));
     fragment->offset = L2CAP_MIN_OFFSET;
     fragment->len = client->remote_mtu;
     memcpy(fragment->data + fragment->offset, bt_packet->data + bt_packet->offset, client->remote_mtu);
diff --git a/stack/pan/pan_main.c b/stack/pan/pan_main.c
index b5e5339c8..eb39a8530 100644
--- a/stack/pan/pan_main.c
+++ b/stack/pan/pan_main.c
@@ -227,33 +227,30 @@ void pan_conn_ind_cb (UINT16 handle,
      * For reference, see Table 1 in PAN Profile v1.0 spec.
      * Note: the remote is the initiator.
      */
-    bool is_valid_interaction = false;
-    switch (remote_uuid->uu.uuid16)
-    {
-        case UUID_SERVCLASS_NAP:
-        case UUID_SERVCLASS_GN:
-            if (local_uuid->uu.uuid16 == UUID_SERVCLASS_PANU)
-                is_valid_interaction = true;
-            break;
-        case UUID_SERVCLASS_PANU:
-            is_valid_interaction = true;
-            break;
+    BOOLEAN is_valid_interaction = FALSE;
+    switch (remote_uuid->uu.uuid16) {
+    case UUID_SERVCLASS_NAP:
+    case UUID_SERVCLASS_GN:
+        if (local_uuid->uu.uuid16 == UUID_SERVCLASS_PANU)
+            is_valid_interaction = TRUE;
+        break;
+    case UUID_SERVCLASS_PANU:
+        is_valid_interaction = TRUE;
+        break;
     }
     /*
      * Explicitly disable connections to the local PANU if the remote is
      * not PANU.
      */
     if ((local_uuid->uu.uuid16 == UUID_SERVCLASS_PANU) &&
-        (remote_uuid->uu.uuid16 != UUID_SERVCLASS_PANU))
-    {
-        is_valid_interaction = false;
+        (remote_uuid->uu.uuid16 != UUID_SERVCLASS_PANU)) {
+        is_valid_interaction = FALSE;
     }
-    if (!is_valid_interaction)
-    {
+    if (!is_valid_interaction) {
         PAN_TRACE_ERROR(
-            "PAN Connection failed because of invalid PAN profile roles "
-            "interaction: Remote UUID 0x%x Local UUID 0x%x",
-            remote_uuid->uu.uuid16, local_uuid->uu.uuid16);
+          "PAN Connection failed because of invalid PAN profile roles "
+          "interaction: Remote UUID 0x%x Local UUID 0x%x",
+          remote_uuid->uu.uuid16, local_uuid->uu.uuid16);
         BNEP_ConnectResp(handle, BNEP_CONN_FAILED_SRC_UUID);
         return;
     }