2022-01-14 23:11:08

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: [PATCH BlueZ 2/2] avrcp: Fix unaligned access

From: Luiz Augusto von Dentz <[email protected]>

This fixes the access to struct media_attribute_header which needs to
be packed and it also replaces the use of ntohs/ntohl to byteorder
conversion helpers which are a lot more clear on what byteorder shall
be used.
---
profiles/audio/avrcp.c | 229 ++++++++++++++++++++---------------------
1 file changed, 111 insertions(+), 118 deletions(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index d4e19ffc0..5eb182b76 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -835,7 +835,7 @@ void avrcp_player_event(struct avrcp_player *player, uint8_t id,
}

done:
- pdu->params_len = htons(size);
+ pdu->params_len = cpu_to_be16(size);

for (l = player->sessions; l; l = l->next) {
struct avrcp *session = l->data;
@@ -933,15 +933,17 @@ static uint16_t player_write_media_attribute(struct avrcp_player *player,
return attr_len;
}

+struct avrcp_media_attribute_hdr {
+ uint32_t id;
+ uint16_t charset;
+ uint16_t len;
+} __attribute__ ((packed));
+
static GList *player_fill_media_attribute(struct avrcp_player *player,
GList *attr_ids, uint8_t *buf,
uint16_t *pos, uint16_t *offset)
{
- struct media_attribute_header {
- uint32_t id;
- uint16_t charset;
- uint16_t len;
- } *hdr = NULL;
+ struct avrcp_media_attribute_hdr *hdr = NULL;
GList *l;

for (l = attr_ids; l != NULL; l = g_list_delete_link(l, l)) {
@@ -953,9 +955,9 @@ static GList *player_fill_media_attribute(struct avrcp_player *player,
break;

hdr = (void *) &buf[*pos];
- hdr->id = htonl(attr);
+ hdr->id = cpu_to_be32(attr);
/* Always use UTF-8 */
- hdr->charset = htons(AVRCP_CHARSET_UTF8);
+ hdr->charset = cpu_to_be16(AVRCP_CHARSET_UTF8);
*pos += sizeof(*hdr);
}

@@ -963,7 +965,7 @@ static GList *player_fill_media_attribute(struct avrcp_player *player,
pos, offset);

if (hdr != NULL)
- hdr->len = htons(attr_len);
+ hdr->len = cpu_to_be16(attr_len);

if (*offset > 0)
break;
@@ -1062,7 +1064,7 @@ static uint8_t avrcp_handle_get_capabilities(struct avrcp *session,
struct avrcp_header *pdu,
uint8_t transaction)
{
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
unsigned int i;

if (len != 1)
@@ -1077,7 +1079,8 @@ static uint8_t avrcp_handle_get_capabilities(struct avrcp *session,
company_ids[i]);
}

- pdu->params_len = htons(2 + (3 * G_N_ELEMENTS(company_ids)));
+ pdu->params_len = cpu_to_be16(2 +
+ (3 * G_N_ELEMENTS(company_ids)));
pdu->params[1] = G_N_ELEMENTS(company_ids);

return AVC_CTYPE_STABLE;
@@ -1090,12 +1093,12 @@ static uint8_t avrcp_handle_get_capabilities(struct avrcp *session,
}
}

- pdu->params_len = htons(2 + pdu->params[1]);
+ pdu->params_len = cpu_to_be16(2 + pdu->params[1]);
return AVC_CTYPE_STABLE;
}

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;

return AVC_CTYPE_REJECTED;
@@ -1114,11 +1117,11 @@ static uint8_t avrcp_handle_list_player_attributes(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
unsigned int i;

if (len != 0) {
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1136,7 +1139,7 @@ static uint8_t avrcp_handle_list_player_attributes(struct avrcp *session,

done:
pdu->params[0] = len;
- pdu->params_len = htons(len + 1);
+ pdu->params_len = cpu_to_be16(len + 1);

return AVC_CTYPE_STABLE;
}
@@ -1146,7 +1149,7 @@ static uint8_t avrcp_handle_list_player_values(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
unsigned int i;

if (len != 1)
@@ -1161,12 +1164,12 @@ static uint8_t avrcp_handle_list_player_values(struct avrcp *session,
pdu->params[i] = i;

pdu->params[0] = len;
- pdu->params_len = htons(len + 1);
+ pdu->params_len = cpu_to_be16(len + 1);

return AVC_CTYPE_STABLE;

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1215,7 +1218,7 @@ static uint8_t avrcp_handle_get_element_attributes(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
uint64_t identifier = get_le64(&pdu->params[0]);
uint16_t pos;
uint8_t nattr;
@@ -1273,11 +1276,11 @@ static uint8_t avrcp_handle_get_element_attributes(struct avrcp *session,
}

pdu->params[0] = len;
- pdu->params_len = htons(pos);
+ pdu->params_len = cpu_to_be16(pos);

return AVC_CTYPE_STABLE;
err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1287,7 +1290,7 @@ static uint8_t avrcp_handle_get_current_player_value(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
uint8_t *settings;
unsigned int i;

@@ -1327,7 +1330,7 @@ static uint8_t avrcp_handle_get_current_player_value(struct avrcp *session,

if (len) {
pdu->params[0] = len / 2;
- pdu->params_len = htons(len + 1);
+ pdu->params_len = cpu_to_be16(len + 1);

return AVC_CTYPE_STABLE;
}
@@ -1335,7 +1338,7 @@ static uint8_t avrcp_handle_get_current_player_value(struct avrcp *session,
error("No valid attributes in request");

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;

return AVC_CTYPE_REJECTED;
@@ -1346,7 +1349,7 @@ static uint8_t avrcp_handle_set_player_value(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
unsigned int i;
uint8_t *param;

@@ -1375,7 +1378,7 @@ static uint8_t avrcp_handle_set_player_value(struct avrcp *session,
}

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1384,10 +1387,10 @@ static uint8_t avrcp_handle_displayable_charset(struct avrcp *session,
struct avrcp_header *pdu,
uint8_t transaction)
{
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);

if (len < 3) {
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1404,7 +1407,7 @@ static uint8_t avrcp_handle_ct_battery_status(struct avrcp *session,
struct avrcp_header *pdu,
uint8_t transaction)
{
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
const char *valstr;

if (len != 1)
@@ -1419,7 +1422,7 @@ static uint8_t avrcp_handle_ct_battery_status(struct avrcp *session,
return AVC_CTYPE_STABLE;

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1481,12 +1484,12 @@ static uint8_t avrcp_handle_get_play_status(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
uint32_t position;
uint32_t duration;

if (len != 0) {
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1494,14 +1497,11 @@ static uint8_t avrcp_handle_get_play_status(struct avrcp *session,
position = player_get_position(player);
duration = player_get_duration(player);

- position = htonl(position);
- duration = htonl(duration);
-
- memcpy(&pdu->params[0], &duration, 4);
- memcpy(&pdu->params[4], &position, 4);
+ put_be32(duration, &pdu->params[0]);
+ put_be32(position, &pdu->params[4]);
pdu->params[8] = player_get_status(player);

- pdu->params_len = htons(9);
+ pdu->params_len = cpu_to_be16(9);

return AVC_CTYPE_STABLE;
}
@@ -1609,7 +1609,7 @@ static uint8_t avrcp_handle_register_notification(struct avrcp *session,
{
struct avrcp_player *player = target_get_player(session);
struct btd_device *dev = session->dev;
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
uint64_t uid;
int8_t volume;

@@ -1670,12 +1670,12 @@ static uint8_t avrcp_handle_register_notification(struct avrcp *session,
session->registered_events |= (1 << pdu->params[0]);
session->transaction_events[pdu->params[0]] = transaction;

- pdu->params_len = htons(len);
+ pdu->params_len = cpu_to_be16(len);

return AVC_CTYPE_INTERIM;

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1685,7 +1685,7 @@ static uint8_t avrcp_handle_request_continuing(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player = target_get_player(session);
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
struct pending_pdu *pending;

if (len != 1 || session->pending_pdu == NULL)
@@ -1711,11 +1711,11 @@ static uint8_t avrcp_handle_request_continuing(struct avrcp *session,
pdu->packet_type = AVRCP_PACKET_TYPE_CONTINUING;
}

- pdu->params_len = htons(len);
+ pdu->params_len = cpu_to_be16(len);

return AVC_CTYPE_STABLE;
err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1724,7 +1724,7 @@ static uint8_t avrcp_handle_abort_continuing(struct avrcp *session,
struct avrcp_header *pdu,
uint8_t transaction)
{
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
struct pending_pdu *pending;

if (len != 1 || session->pending_pdu == NULL)
@@ -1741,7 +1741,7 @@ static uint8_t avrcp_handle_abort_continuing(struct avrcp *session,
return AVC_CTYPE_ACCEPTED;

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1750,7 +1750,7 @@ static uint8_t avrcp_handle_set_absolute_volume(struct avrcp *session,
struct avrcp_header *pdu,
uint8_t transaction)
{
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
int8_t volume;

if (len != 1)
@@ -1763,7 +1763,7 @@ static uint8_t avrcp_handle_set_absolute_volume(struct avrcp *session,
return AVC_CTYPE_ACCEPTED;

err:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INVALID_PARAM;
return AVC_CTYPE_REJECTED;
}
@@ -1821,7 +1821,7 @@ static uint8_t avrcp_handle_set_addressed_player(struct avrcp *session,
uint8_t transaction)
{
struct avrcp_player *player;
- uint16_t len = ntohs(pdu->params_len);
+ uint16_t len = be16_to_cpu(pdu->params_len);
uint16_t player_id = 0;
uint8_t status;

@@ -1837,7 +1837,7 @@ static uint8_t avrcp_handle_set_addressed_player(struct avrcp *session,
if (player) {
player->addressed = true;
status = AVRCP_STATUS_SUCCESS;
- pdu->params_len = htons(len);
+ pdu->params_len = cpu_to_be16(len);
pdu->params[0] = status;
} else {
status = AVRCP_STATUS_INVALID_PLAYER_ID;
@@ -1853,7 +1853,7 @@ static uint8_t avrcp_handle_set_addressed_player(struct avrcp *session,
return AVC_CTYPE_ACCEPTED;

err:
- pdu->params_len = htons(sizeof(status));
+ pdu->params_len = cpu_to_be16(sizeof(status));
pdu->params[0] = status;
return AVC_CTYPE_REJECTED;
}
@@ -1911,7 +1911,7 @@ static size_t handle_vendordep_pdu(struct avctp *conn, uint8_t transaction,
}

DBG("AVRCP PDU 0x%02X, company 0x%06X len 0x%04X",
- pdu->pdu_id, company_id, ntohs(pdu->params_len));
+ pdu->pdu_id, company_id, be16_to_cpu(pdu->params_len));

pdu->packet_type = 0;
pdu->rsvd = 0;
@@ -1924,9 +1924,9 @@ static size_t handle_vendordep_pdu(struct avctp *conn, uint8_t transaction,
operands += sizeof(*pdu);
operand_count -= sizeof(*pdu);

- if (ntohs(pdu->params_len) != operand_count) {
+ if (be16_to_cpu(pdu->params_len) != operand_count) {
DBG("AVRCP PDU parameters length don't match");
- pdu->params_len = htons(operand_count);
+ pdu->params_len = cpu_to_be16(operand_count);
}

for (handler = session->control_handlers; handler->pdu_id; handler++) {
@@ -1952,10 +1952,10 @@ static size_t handle_vendordep_pdu(struct avctp *conn, uint8_t transaction,
pdu->pdu_id != AVRCP_ABORT_CONTINUING)
session_abort_pending_pdu(session);

- return AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ return AVRCP_HEADER_LENGTH + be16_to_cpu(pdu->params_len);

err_metadata:
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
*code = AVC_CTYPE_REJECTED;

return AVRCP_HEADER_LENGTH + 1;
@@ -1972,7 +1972,7 @@ static void avrcp_handle_media_player_list(struct avrcp *session,

rsp = (void *)pdu->params;
rsp->status = AVRCP_STATUS_SUCCESS;
- rsp->uid_counter = htons(player_get_uid_counter(player));
+ rsp->uid_counter = cpu_to_be16(player_get_uid_counter(player));
rsp->num_items = 0;
pdu->param_len = sizeof(*rsp);

@@ -1992,22 +1992,22 @@ static void avrcp_handle_media_player_list(struct avrcp *session,
pdu->param_len += sizeof(*folder);

item = (void *)folder->data;
- item->player_id = htons(player->id);
+ item->player_id = cpu_to_be16(player->id);
item->type = 0x01; /* Audio */
- item->subtype = htonl(0x01); /* Audio Book */
+ item->subtype = cpu_to_be32(0x00000001); /* Audio Book */
item->status = player_get_status(player);
/* Assign Default Feature Bit Mask */
memcpy(&item->features, &default_features,
sizeof(default_features));

- item->charset = htons(AVRCP_CHARSET_UTF8);
+ item->charset = cpu_to_be16(AVRCP_CHARSET_UTF8);

name = player->cb->get_name(player->user_data);
namelen = strlen(name);
- item->namelen = htons(namelen);
+ item->namelen = cpu_to_be16(namelen);
memcpy(item->name, name, namelen);

- folder->len = htons(sizeof(*item) + namelen);
+ folder->len = cpu_to_be16(sizeof(*item) + namelen);
pdu->param_len += sizeof(*item) + namelen;
rsp->num_items++;
}
@@ -2016,14 +2016,14 @@ static void avrcp_handle_media_player_list(struct avrcp *session,
if (!rsp->num_items)
goto failed;

- rsp->num_items = htons(rsp->num_items);
- pdu->param_len = htons(pdu->param_len);
+ rsp->num_items = cpu_to_be16(rsp->num_items);
+ pdu->param_len = cpu_to_be16(pdu->param_len);

return;

failed:
pdu->params[0] = AVRCP_STATUS_OUT_OF_BOUNDS;
- pdu->param_len = htons(1);
+ pdu->param_len = cpu_to_be16(1);
}

static void avrcp_handle_get_folder_items(struct avrcp *session,
@@ -2035,7 +2035,7 @@ static void avrcp_handle_get_folder_items(struct avrcp *session,
uint8_t scope;
uint8_t status = AVRCP_STATUS_SUCCESS;

- if (ntohs(pdu->param_len) < 10) {
+ if (be16_to_cpu(pdu->param_len) < 10) {
status = AVRCP_STATUS_INVALID_PARAM;
goto failed;
}
@@ -2069,7 +2069,7 @@ static void avrcp_handle_get_folder_items(struct avrcp *session,

failed:
pdu->params[0] = status;
- pdu->param_len = htons(1);
+ pdu->param_len = cpu_to_be16(1);
}

static void avrcp_handle_media_player_list_num_items(struct avrcp *session,
@@ -2080,9 +2080,9 @@ static void avrcp_handle_media_player_list_num_items(struct avrcp *session,

rsp = (void *)pdu->params;
rsp->status = AVRCP_STATUS_SUCCESS;
- rsp->uid_counter = htons(player_get_uid_counter(player));
- rsp->num_items = htonl(g_slist_length(session->server->players));
- pdu->param_len = htons(sizeof(*rsp));
+ rsp->uid_counter = cpu_to_be16(player_get_uid_counter(player));
+ rsp->num_items = cpu_to_be32(g_slist_length(session->server->players));
+ pdu->param_len = cpu_to_be16(sizeof(*rsp));
}

static void avrcp_handle_get_total_number_of_items(struct avrcp *session,
@@ -2092,7 +2092,7 @@ static void avrcp_handle_get_total_number_of_items(struct avrcp *session,
uint8_t scope;
uint8_t status = AVRCP_STATUS_SUCCESS;

- if (ntohs(pdu->param_len) != 1) {
+ if (be16_to_cpu(pdu->param_len) != 1) {
status = AVRCP_STATUS_INVALID_PARAM;
goto failed;
}
@@ -2115,7 +2115,7 @@ static void avrcp_handle_get_total_number_of_items(struct avrcp *session,

failed:
pdu->params[0] = status;
- pdu->param_len = htons(1);
+ pdu->param_len = cpu_to_be16(1);
}

static struct browsing_pdu_handler {
@@ -2137,7 +2137,7 @@ size_t avrcp_browsing_general_reject(uint8_t *operands)
pdu->pdu_id = AVRCP_GENERAL_REJECT;
status = AVRCP_STATUS_INVALID_COMMAND;

- pdu->param_len = htons(sizeof(status));
+ pdu->param_len = cpu_to_be16(sizeof(status));
memcpy(pdu->params, &status, (sizeof(status)));
return AVRCP_BROWSING_HEADER_LENGTH + sizeof(status);
}
@@ -2151,7 +2151,7 @@ static size_t handle_browsing_pdu(struct avctp *conn,
struct avrcp_browsing_header *pdu = (void *) operands;

DBG("AVRCP Browsing PDU 0x%02X, len 0x%04X", pdu->pdu_id,
- ntohs(pdu->param_len));
+ be16_to_cpu(pdu->param_len));

for (handler = browsing_handlers; handler->pdu_id; handler++) {
if (handler->pdu_id == pdu->pdu_id)
@@ -2163,7 +2163,7 @@ static size_t handle_browsing_pdu(struct avctp *conn,
done:
session->transaction = transaction;
handler->func(session, pdu, transaction);
- return AVRCP_BROWSING_HEADER_LENGTH + ntohs(pdu->param_len);
+ return AVRCP_BROWSING_HEADER_LENGTH + be16_to_cpu(pdu->param_len);
}

size_t avrcp_handle_vendor_reject(uint8_t *code, uint8_t *operands)
@@ -2172,11 +2172,11 @@ size_t avrcp_handle_vendor_reject(uint8_t *code, uint8_t *operands)
uint32_t company_id = get_company_id(pdu->company_id);

*code = AVC_CTYPE_REJECTED;
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);
pdu->params[0] = AVRCP_STATUS_INTERNAL_ERROR;

DBG("rejecting AVRCP PDU 0x%02X, company 0x%06X len 0x%04X",
- pdu->pdu_id, company_id, ntohs(pdu->params_len));
+ pdu->pdu_id, company_id, be16_to_cpu(pdu->params_len));

return AVRCP_HEADER_LENGTH + 1;
}
@@ -2227,18 +2227,16 @@ static gboolean avrcp_get_play_status_rsp(struct avctp *conn, uint8_t code,
uint8_t status;

if (pdu == NULL || code == AVC_CTYPE_REJECTED ||
- ntohs(pdu->params_len) != 9)
+ be16_to_cpu(pdu->params_len) != 9)
return FALSE;

- memcpy(&duration, pdu->params, sizeof(uint32_t));
- duration = ntohl(duration);
+ duration = get_be32(pdu->params);
media_player_set_duration(mp, duration);

- memcpy(&position, pdu->params + 4, sizeof(uint32_t));
- position = ntohl(position);
+ position = get_be32(pdu->params + 4);
media_player_set_position(mp, position);

- memcpy(&status, pdu->params + 8, sizeof(uint8_t));
+ status = get_u8(pdu->params + 8);
media_player_set_status(mp, status_to_string(status));

return FALSE;
@@ -2335,7 +2333,7 @@ static void avrcp_get_current_player_value(struct avrcp *session,
set_company_id(pdu->company_id, IEEEID_BTSIG);
pdu->pdu_id = AVRCP_GET_CURRENT_PLAYER_VALUE;
pdu->packet_type = AVRCP_PACKET_TYPE_SINGLE;
- pdu->params_len = htons(count + 1);
+ pdu->params_len = cpu_to_be16(count + 1);
pdu->params[0] = count;

memcpy(pdu->params + 1, attrs, count);
@@ -2361,7 +2359,7 @@ static gboolean avrcp_list_player_attributes_rsp(struct avctp *conn,

len = pdu->params[0];

- if (ntohs(pdu->params_len) < count) {
+ if (be16_to_cpu(pdu->params_len) < count) {
error("Invalid parameters");
return FALSE;
}
@@ -2449,7 +2447,7 @@ static gboolean avrcp_get_element_attributes_rsp(struct avctp *conn,

count = pdu->params[0];

- if (ntohs(pdu->params_len) - 1 < count * 8) {
+ if (be16_to_cpu(pdu->params_len) - 1 < count * 8) {
error("Invalid parameters");
return FALSE;
}
@@ -2471,10 +2469,10 @@ static void avrcp_get_element_attributes(struct avrcp *session)

set_company_id(pdu->company_id, IEEEID_BTSIG);
pdu->pdu_id = AVRCP_GET_ELEMENT_ATTRIBUTES;
- pdu->params_len = htons(9);
+ pdu->params_len = cpu_to_be16(9);
pdu->packet_type = AVRCP_PACKET_TYPE_SINGLE;

- length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ length = AVRCP_HEADER_LENGTH + be16_to_cpu(pdu->params_len);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_STATUS,
AVC_SUBUNIT_PANEL, buf, length,
@@ -2695,12 +2693,11 @@ static void avrcp_list_items(struct avrcp *session, uint32_t start,
struct avrcp_player *player = session->controller->player;
struct avrcp_browsing_header *pdu = (void *) buf;
uint16_t length = AVRCP_BROWSING_HEADER_LENGTH + 10;
- uint32_t attribute;

memset(buf, 0, sizeof(buf));

pdu->pdu_id = AVRCP_GET_FOLDER_ITEMS;
- pdu->param_len = htons(10 + sizeof(uint32_t));
+ pdu->param_len = cpu_to_be16(10 + sizeof(uint32_t));

pdu->params[0] = player->scope;

@@ -2711,8 +2708,7 @@ static void avrcp_list_items(struct avrcp *session, uint32_t start,

/* Only the title (0x01) is mandatory. This can be extended to
* support AVRCP_MEDIA_ATTRIBUTE_* attributes */
- attribute = htonl(AVRCP_MEDIA_ATTRIBUTE_TITLE);
- memcpy(&pdu->params[10], &attribute, sizeof(uint32_t));
+ put_be32(AVRCP_MEDIA_ATTRIBUTE_TITLE, &pdu->params[10]);

length += sizeof(uint32_t);

@@ -2823,9 +2819,9 @@ static void avrcp_set_browsed_player(struct avrcp *session,
memset(buf, 0, sizeof(buf));

pdu->pdu_id = AVRCP_SET_BROWSED_PLAYER;
- id = htons(player->id);
+ id = cpu_to_be16(player->id);
memcpy(pdu->params, &id, 2);
- pdu->param_len = htons(2);
+ pdu->param_len = cpu_to_be16(2);

avctp_send_browsing_req(session->conn, buf, sizeof(buf),
avrcp_set_browsed_player_rsp, session);
@@ -2853,7 +2849,7 @@ static gboolean avrcp_get_item_attributes_rsp(struct avctp *conn,

count = pdu->params[1];

- if (ntohs(pdu->param_len) - 1 < count * 8) {
+ if (be16_to_cpu(pdu->param_len) - 1 < count * 8) {
error("Invalid parameters");
return FALSE;
}
@@ -2877,7 +2873,7 @@ static void avrcp_get_item_attributes(struct avrcp *session, uint64_t uid)
pdu->params[0] = 0x03;
put_be64(uid, &pdu->params[1]);
put_be16(player->uid_counter, &pdu->params[9]);
- pdu->param_len = htons(12);
+ pdu->param_len = cpu_to_be16(12);

avctp_send_browsing_req(session->conn, buf, sizeof(buf),
avrcp_get_item_attributes_rsp, session);
@@ -2921,9 +2917,9 @@ static void avrcp_set_player_value(struct avrcp *session, uint8_t attr,
pdu->params[0] = 1;
pdu->params[1] = attr;
pdu->params[2] = val;
- pdu->params_len = htons(3);
+ pdu->params_len = cpu_to_be16(3);

- length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ length = AVRCP_HEADER_LENGTH + be16_to_cpu(pdu->params_len);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_CONTROL,
AVC_SUBUNIT_PANEL, buf, length,
@@ -2959,9 +2955,9 @@ static void avrcp_set_addressed_player(struct avrcp *session,
set_company_id(pdu->company_id, IEEEID_BTSIG);
pdu->pdu_id = AVRCP_SET_ADDRESSED_PLAYER;
pdu->packet_type = AVRCP_PACKET_TYPE_SINGLE;
- id = htons(player->id);
+ id = cpu_to_be16(player->id);
memcpy(pdu->params, &id, 2);
- pdu->params_len = htons(2);
+ pdu->params_len = cpu_to_be16(2);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_CONTROL,
AVC_SUBUNIT_PANEL, buf, sizeof(buf),
@@ -3189,7 +3185,7 @@ static void avrcp_change_path(struct avrcp *session, uint8_t direction,
pdu->params[2] = direction;
put_be64(uid, &pdu->params[3]);
pdu->pdu_id = AVRCP_CHANGE_PATH;
- pdu->param_len = htons(11);
+ pdu->param_len = cpu_to_be16(11);

avctp_send_browsing_req(session->conn, buf, sizeof(buf),
avrcp_change_path_rsp, session);
@@ -3257,7 +3253,7 @@ static void avrcp_search(struct avrcp *session, const char *string)
put_be16(stringlen, &pdu->params[2]);
memcpy(&pdu->params[4], string, stringlen);
pdu->pdu_id = AVRCP_SEARCH;
- pdu->param_len = htons(len - AVRCP_BROWSING_HEADER_LENGTH);
+ pdu->param_len = cpu_to_be16(len - AVRCP_BROWSING_HEADER_LENGTH);

avctp_send_browsing_req(session->conn, buf, len, avrcp_search_rsp,
session);
@@ -3323,14 +3319,14 @@ static void avrcp_play_item(struct avrcp *session, uint64_t uid)

set_company_id(pdu->company_id, IEEEID_BTSIG);
pdu->pdu_id = AVRCP_PLAY_ITEM;
- pdu->params_len = htons(11);
+ pdu->params_len = cpu_to_be16(11);
pdu->packet_type = AVRCP_PACKET_TYPE_SINGLE;

pdu->params[0] = player->scope;
put_be64(uid, &pdu->params[1]);
put_be16(player->uid_counter, &pdu->params[9]);

- length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ length = AVRCP_HEADER_LENGTH + be16_to_cpu(pdu->params_len);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_CONTROL,
AVC_SUBUNIT_PANEL, buf, length,
@@ -3372,14 +3368,14 @@ static void avrcp_add_to_nowplaying(struct avrcp *session, uint64_t uid)

set_company_id(pdu->company_id, IEEEID_BTSIG);
pdu->pdu_id = AVRCP_ADD_TO_NOW_PLAYING;
- pdu->params_len = htons(11);
+ pdu->params_len = cpu_to_be16(11);
pdu->packet_type = AVRCP_PACKET_TYPE_SINGLE;

pdu->params[0] = player->scope;
put_be64(uid, &pdu->params[1]);
put_be16(player->uid_counter, &pdu->params[9]);

- length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ length = AVRCP_HEADER_LENGTH + be16_to_cpu(pdu->params_len);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_CONTROL,
AVC_SUBUNIT_PANEL, buf, length,
@@ -3447,7 +3443,7 @@ static void avrcp_get_total_numberofitems(struct avrcp *session)
memset(buf, 0, sizeof(buf));

pdu->pdu_id = AVRCP_GET_TOTAL_NUMBER_OF_ITEMS;
- pdu->param_len = htons(7 + sizeof(uint32_t));
+ pdu->param_len = cpu_to_be16(7 + sizeof(uint32_t));

pdu->params[0] = player->scope;

@@ -3715,7 +3711,7 @@ static void avrcp_get_media_player_list(struct avrcp *session)
pdu->pdu_id = AVRCP_GET_FOLDER_ITEMS;
put_be32(0, &pdu->params[1]);
put_be32(UINT32_MAX, &pdu->params[5]);
- pdu->param_len = htons(10);
+ pdu->param_len = cpu_to_be16(10);

avctp_send_browsing_req(session->conn, buf, sizeof(buf),
avrcp_get_media_player_list_rsp, session);
@@ -3935,9 +3931,9 @@ static void avrcp_register_notification(struct avrcp *session, uint8_t event)
if (event == AVRCP_EVENT_PLAYBACK_POS_CHANGED)
bt_put_be32(UINT32_MAX / 1000, &pdu->params[1]);

- pdu->params_len = htons(AVRCP_REGISTER_NOTIFICATION_PARAM_LENGTH);
+ pdu->params_len = cpu_to_be16(AVRCP_REGISTER_NOTIFICATION_PARAM_LENGTH);

- length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ length = AVRCP_HEADER_LENGTH + be16_to_cpu(pdu->params_len);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_NOTIFY,
AVC_SUBUNIT_PANEL, buf, length,
@@ -4015,7 +4011,6 @@ static void avrcp_get_capabilities(struct avrcp *session)
{
uint8_t buf[AVRCP_HEADER_LENGTH + AVRCP_GET_CAPABILITIES_PARAM_LENGTH];
struct avrcp_header *pdu = (void *) buf;
- uint8_t length;

memset(buf, 0, sizeof(buf));

@@ -4023,12 +4018,10 @@ static void avrcp_get_capabilities(struct avrcp *session)
pdu->pdu_id = AVRCP_GET_CAPABILITIES;
pdu->packet_type = AVRCP_PACKET_TYPE_SINGLE;
pdu->params[0] = CAP_EVENTS_SUPPORTED;
- pdu->params_len = htons(AVRCP_GET_CAPABILITIES_PARAM_LENGTH);
-
- length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
+ pdu->params_len = cpu_to_be16(AVRCP_GET_CAPABILITIES_PARAM_LENGTH);

avctp_send_vendordep_req(session->conn, AVC_CTYPE_STATUS,
- AVC_SUBUNIT_PANEL, buf, length,
+ AVC_SUBUNIT_PANEL, buf, sizeof(buf),
avrcp_get_capabilities_resp,
session);
}
@@ -4535,7 +4528,7 @@ static int avrcp_event(struct avrcp *session, uint8_t id, const void *data)
return -EINVAL;
}

- pdu->params_len = htons(size);
+ pdu->params_len = cpu_to_be16(size);

err = avctp_send_vendordep(session->conn,
session->transaction_events[id],
@@ -4590,7 +4583,7 @@ int avrcp_set_volume(struct btd_device *dev, int8_t volume, bool notify)

pdu->pdu_id = AVRCP_SET_ABSOLUTE_VOLUME;
pdu->params[0] = volume;
- pdu->params_len = htons(1);
+ pdu->params_len = cpu_to_be16(1);

return avctp_send_vendordep_req(session->conn,
AVC_CTYPE_CONTROL, AVC_SUBUNIT_PANEL,
--
2.33.1