Fixed LLCP socket options storage.

Socket options are now copied in the libnfc to avoid referencing a pointer that
may not be valid during the whole socket life cycle.

Change-Id: I7266164bf157242df1ce7fb7a0f9cffd52938140
Signed-off-by: Nick Pelly <npelly@google.com>

4 files changed, 31 insertions, 26 deletions

diff --git a/src/phFriNfc_LlcpTransport.c b/src/phFriNfc_LlcpTransport.c
index 523a6bd..408f058 100644
--- a/src/phFriNfc_LlcpTransport.c
+++ b/src/phFriNfc_LlcpTransport.c
@@ -154,7 +154,6 @@ NFCSTATUS phFriNfc_LlcpTransport_Reset (phFriNfc_LlcpTransport_t      *pLlcpTran
          pLlcpTransport->pSocketTable[i].bufferRwMaxLength              = 0;
          pLlcpTransport->pSocketTable[i].ReceiverBusyCondition          = FALSE;
          pLlcpTransport->pSocketTable[i].RemoteBusyConditionInfo        = FALSE;
-         pLlcpTransport->pSocketTable[i].psSocketOption                 = NULL;
          pLlcpTransport->pSocketTable[i].socket_sSap                    = PHFRINFC_LLCP_SAP_DEFAULT;
          pLlcpTransport->pSocketTable[i].socket_dSap                    = PHFRINFC_LLCP_SAP_DEFAULT;
          pLlcpTransport->pSocketTable[i].bSocketRecvPending             = FALSE;
@@ -184,6 +183,8 @@ NFCSTATUS phFriNfc_LlcpTransport_Reset (phFriNfc_LlcpTransport_t      *pLlcpTran
          pLlcpTransport->pSocketTable[i].indexRwRead                    = 0;
          pLlcpTransport->pSocketTable[i].indexRwWrite                   = 0;
 
+         memset(&pLlcpTransport->pSocketTable[i].sSocketOption, 0x00, sizeof(phFriNfc_LlcpTransport_sSocketOptions_t));
+
          if (pLlcpTransport->pSocketTable[i].sServiceName.buffer != NULL) {
             phOsalNfc_FreeMemory(pLlcpTransport->pSocketTable[i].sServiceName.buffer);
          }
@@ -387,15 +388,15 @@ NFCSTATUS phFriNfc_LlcpTransport_Socket(phFriNfc_LlcpTransport_t
                   status = PHNFCSTVAL(CID_FRI_NFC_LLCP_TRANSPORT, NFCSTATUS_INVALID_PARAMETER);
                }
                /* Set socket options */
-               pLlcpTransport->pSocketTable[index].psSocketOption   = psOptions;
+               memcpy(&pLlcpTransport->pSocketTable[index].sSocketOption, psOptions, sizeof(phFriNfc_LlcpTransport_sSocketOptions_t));
 
                /* Set socket local params (MIUX & RW) */
-               pLlcpTransport->pSocketTable[index].localMIUX = (pLlcpTransport->pSocketTable[index].psSocketOption->miu - PHFRINFC_LLCP_MIU_DEFAULT) & PHFRINFC_LLCP_TLV_MIUX_MASK;
-               pLlcpTransport->pSocketTable[index].localRW   = pLlcpTransport->pSocketTable[index].psSocketOption->rw & PHFRINFC_LLCP_TLV_RW_MASK;
+               pLlcpTransport->pSocketTable[index].localMIUX = (pLlcpTransport->pSocketTable[index].sSocketOption.miu - PHFRINFC_LLCP_MIU_DEFAULT) & PHFRINFC_LLCP_TLV_MIUX_MASK;
+               pLlcpTransport->pSocketTable[index].localRW   = pLlcpTransport->pSocketTable[index].sSocketOption.rw & PHFRINFC_LLCP_TLV_RW_MASK;
 
                /* Set the Max length for the Send and Receive Window Buffer */
-               pLlcpTransport->pSocketTable[index].bufferSendMaxLength   = pLlcpTransport->pSocketTable[index].psSocketOption->miu;
-               pLlcpTransport->pSocketTable[index].bufferRwMaxLength     = pLlcpTransport->pSocketTable[index].psSocketOption->miu * ((pLlcpTransport->pSocketTable[index].psSocketOption->rw & PHFRINFC_LLCP_TLV_RW_MASK));
+               pLlcpTransport->pSocketTable[index].bufferSendMaxLength   = pLlcpTransport->pSocketTable[index].sSocketOption.miu;
+               pLlcpTransport->pSocketTable[index].bufferRwMaxLength     = pLlcpTransport->pSocketTable[index].sSocketOption.miu * ((pLlcpTransport->pSocketTable[index].sSocketOption.rw & PHFRINFC_LLCP_TLV_RW_MASK));
                pLlcpTransport->pSocketTable[index].bufferLinearLength    = psWorkingBuffer->length - pLlcpTransport->pSocketTable[index].bufferSendMaxLength - pLlcpTransport->pSocketTable[index].bufferRwMaxLength;
 
                /* Test the connection oriented buffers length */
@@ -409,7 +410,7 @@ NFCSTATUS phFriNfc_LlcpTransport_Socket(phFriNfc_LlcpTransport_t
                /* Set the pointer and the length for the Receive Window Buffer */
                for(cpt=0;cpt<pLlcpTransport->pSocketTable[index].localRW;cpt++)
                {
-                  pLlcpTransport->pSocketTable[index].sSocketRwBufferTable[cpt].buffer = psWorkingBuffer->buffer + (cpt*pLlcpTransport->pSocketTable[index].psSocketOption->miu);
+                  pLlcpTransport->pSocketTable[index].sSocketRwBufferTable[cpt].buffer = psWorkingBuffer->buffer + (cpt*pLlcpTransport->pSocketTable[index].sSocketOption.miu);
                   pLlcpTransport->pSocketTable[index].sSocketRwBufferTable[cpt].length = 0;
                }
 
diff --git a/src/phFriNfc_LlcpTransport.h b/src/phFriNfc_LlcpTransport.h
index 27fda96..0cc3721 100644
--- a/src/phFriNfc_LlcpTransport.h
+++ b/src/phFriNfc_LlcpTransport.h
@@ -155,12 +155,13 @@ struct phFriNfc_LlcpTransport_Socket
 {
    phFriNfc_LlcpTransportSocket_eSocketState_t    eSocket_State;
    phFriNfc_LlcpTransport_eSocketType_t           eSocket_Type;
-   phFriNfc_LlcpTransport_sSocketOptions_t*       psSocketOption;
+   phFriNfc_LlcpTransport_sSocketOptions_t        sSocketOption;
    pphFriNfc_LlcpTransportSocketErrCb_t           pSocketErrCb;
 
    /* Remote and local socket info */
    uint8_t                                        socket_sSap;
    uint8_t                                        socket_dSap;
+   // TODO: copy service name (could be deallocated by upper layer)
    phNfc_sData_t                                  sServiceName;
    uint8_t                                        remoteRW;
    uint8_t                                        localRW;
@@ -683,4 +684,4 @@ NFCSTATUS phFriNfc_LlcpTransport_SendTo( phFriNfc_LlcpTransport_Socket_t
                                          phNfc_sData_t*                              psBuffer,
                                          pphFriNfc_LlcpTransportSocketSendCb_t       pSend_RspCb,
                                          void*                                       pContext);
-#endif  /*  PHFRINFC_LLCP_TRANSPORT_H    */
\ No newline at end of file
+#endif  /*  PHFRINFC_LLCP_TRANSPORT_H    */
diff --git a/src/phFriNfc_LlcpTransport_Connection.c b/src/phFriNfc_LlcpTransport_Connection.c
index 5b114c2..2db1192 100644
--- a/src/phFriNfc_LlcpTransport_Connection.c
+++ b/src/phFriNfc_LlcpTransport_Connection.c
@@ -1814,10 +1814,10 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_SocketGetLocalOptions(phFriN
    NFCSTATUS status = NFCSTATUS_SUCCESS;
 
    /* Get Local MIUX */
-   psLocalOptions->miu = pLlcpSocket->psSocketOption->miu;
+   psLocalOptions->miu = pLlcpSocket->sSocketOption.miu;
 
    /* Get Local Receive Window */
-   psLocalOptions->rw = pLlcpSocket->psSocketOption->rw;
+   psLocalOptions->rw = pLlcpSocket->sSocketOption.rw;
 
    return status;
 }
@@ -1977,16 +1977,16 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_Accept(phFriNfc_LlcpTranspor
    uint8_t  i;
 
    /* Store the options in the socket */
-   pLlcpSocket->psSocketOption   = psOptions;
+   memcpy(&pLlcpSocket->sSocketOption, psOptions, sizeof(phFriNfc_LlcpTransport_sSocketOptions_t));
 
    /* Set socket local params (MIUX & RW) */
-   pLlcpSocket ->localMIUX = (pLlcpSocket->psSocketOption->miu - PHFRINFC_LLCP_MIU_DEFAULT) & PHFRINFC_LLCP_TLV_MIUX_MASK;
-   pLlcpSocket ->localRW   = pLlcpSocket->psSocketOption->rw & PHFRINFC_LLCP_TLV_RW_MASK;
+   pLlcpSocket ->localMIUX = (pLlcpSocket->sSocketOption.miu - PHFRINFC_LLCP_MIU_DEFAULT) & PHFRINFC_LLCP_TLV_MIUX_MASK;
+   pLlcpSocket ->localRW   = pLlcpSocket->sSocketOption.rw & PHFRINFC_LLCP_TLV_RW_MASK;
 
    /* Set the pointer and the length for the Receive Window Buffer */
    for(i=0;i<pLlcpSocket->localRW;i++)
    {
-      pLlcpSocket->sSocketRwBufferTable[i].buffer = psWorkingBuffer->buffer + (i*pLlcpSocket->psSocketOption->miu);
+      pLlcpSocket->sSocketRwBufferTable[i].buffer = psWorkingBuffer->buffer + (i*pLlcpSocket->sSocketOption.miu);
       pLlcpSocket->sSocketRwBufferTable[i].length = 0;
    }
 
@@ -2043,17 +2043,17 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_Accept(phFriNfc_LlcpTranspor
    }
 
    /* Recive Window */
-   if(pLlcpSocket->psSocketOption->rw != PHFRINFC_LLCP_RW_DEFAULT)
+   if(pLlcpSocket->sSocketOption.rw != PHFRINFC_LLCP_RW_DEFAULT)
    {
       /* Encode RW value */
-      phFriNfc_Llcp_EncodeRW(&pLlcpSocket->psSocketOption->rw);
+      phFriNfc_Llcp_EncodeRW(&pLlcpSocket->sSocketOption.rw);
 
       /* Encode RW in TLV format */
       status =  phFriNfc_Llcp_EncodeTLV(&pLlcpSocket->sSocketSendBuffer,
                                         &offset,
                                         PHFRINFC_LLCP_TLV_TYPE_RW,
                                         PHFRINFC_LLCP_TLV_LENGTH_RW,
-                                        &pLlcpSocket->psSocketOption->rw);
+                                        &pLlcpSocket->sSocketOption.rw);
       if(status != NFCSTATUS_SUCCESS)
       {
          /* Call the CB */
@@ -2221,17 +2221,17 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_Connect( phFriNfc_LlcpTransp
    }
 
    /* Recive Window */
-   if(pLlcpSocket->psSocketOption->rw != PHFRINFC_LLCP_RW_DEFAULT)
+   if(pLlcpSocket->sSocketOption.rw != PHFRINFC_LLCP_RW_DEFAULT)
    {
       /* Encode RW value */
-      phFriNfc_Llcp_EncodeRW(&pLlcpSocket->psSocketOption->rw);
+      phFriNfc_Llcp_EncodeRW(&pLlcpSocket->sSocketOption.rw);
 
       /* Encode RW in TLV format */
       status =  phFriNfc_Llcp_EncodeTLV(&pLlcpSocket->sSocketSendBuffer,
                                         &offset,
                                         PHFRINFC_LLCP_TLV_TYPE_RW,
                                         PHFRINFC_LLCP_TLV_LENGTH_RW,
-                                        &pLlcpSocket->psSocketOption->rw);
+                                        &pLlcpSocket->sSocketOption.rw);
       if(status != NFCSTATUS_SUCCESS)
       {
          status = PHNFCSTVAL(CID_FRI_NFC_LLCP_TRANSPORT, NFCSTATUS_FAILED);
@@ -2399,7 +2399,6 @@ static void phFriNfc_LlcpTransport_ConnectionOriented_DisconnectClose_CB(void*
       pLlcpSocket->eSocket_Type                       = phFriNfc_LlcpTransport_eDefaultType;
       pLlcpSocket->pContext                           = NULL;
       pLlcpSocket->pSocketErrCb                       = NULL;
-      pLlcpSocket->psSocketOption                     = NULL;
       pLlcpSocket->socket_sSap                        = PHFRINFC_LLCP_SAP_DEFAULT;
       pLlcpSocket->socket_dSap                        = PHFRINFC_LLCP_SAP_DEFAULT;
       pLlcpSocket->bSocketRecvPending                 = FALSE;
@@ -2415,7 +2414,9 @@ static void phFriNfc_LlcpTransport_ConnectionOriented_DisconnectClose_CB(void*
       pLlcpSocket->socket_VSA                         = 0;
       pLlcpSocket->socket_VR                          = 0;
       pLlcpSocket->socket_VRA                         = 0;
-      
+
+      memset(&pLlcpSocket->sSocketOption, 0x00, sizeof(phFriNfc_LlcpTransport_sSocketOptions_t));
+
       if (pLlcpSocket->sServiceName.buffer != NULL) {
           phOsalNfc_FreeMemory(pLlcpSocket->sServiceName.buffer);
       }
@@ -2460,7 +2461,6 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_Close(phFriNfc_LlcpTransport
       pLlcpSocket->eSocket_Type                       = phFriNfc_LlcpTransport_eDefaultType;
       pLlcpSocket->pContext                           = NULL;
       pLlcpSocket->pSocketErrCb                       = NULL;
-      pLlcpSocket->psSocketOption                     = NULL;
       pLlcpSocket->socket_sSap                        = PHFRINFC_LLCP_SAP_DEFAULT;
       pLlcpSocket->socket_dSap                        = PHFRINFC_LLCP_SAP_DEFAULT;
       pLlcpSocket->bSocketRecvPending                 = FALSE;
@@ -2479,6 +2479,8 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_Close(phFriNfc_LlcpTransport
       pLlcpSocket->socket_VR                          = 0;
       pLlcpSocket->socket_VRA                         = 0;
 
+      memset(&pLlcpSocket->sSocketOption, 0x00, sizeof(phFriNfc_LlcpTransport_sSocketOptions_t));
+
       if (pLlcpSocket->sServiceName.buffer != NULL) {
           phOsalNfc_FreeMemory(pLlcpSocket->sServiceName.buffer);
       }
@@ -2741,7 +2743,7 @@ NFCSTATUS phFriNfc_LlcpTransport_ConnectionOriented_Recv( phFriNfc_LlcpTransport
             {
                /* Get the data length available in the linear buffer  */
                dataLengthAvailable = phFriNfc_Llcp_CyclicFifoAvailable(&pLlcpSocket->sCyclicFifoBuffer);
-               if((dataLengthAvailable >= pLlcpSocket->psSocketOption->miu) && (pLlcpSocket->ReceiverBusyCondition == TRUE))
+               if((dataLengthAvailable >= pLlcpSocket->sSocketOption.miu) && (pLlcpSocket->ReceiverBusyCondition == TRUE))
                {
                   /* Reset the ReceiverBusyCondition Flag */
                   pLlcpSocket->ReceiverBusyCondition = FALSE;
diff --git a/src/phFriNfc_LlcpTransport_Connectionless.c b/src/phFriNfc_LlcpTransport_Connectionless.c
index 60c8d49..72397ad 100644
--- a/src/phFriNfc_LlcpTransport_Connectionless.c
+++ b/src/phFriNfc_LlcpTransport_Connectionless.c
@@ -92,7 +92,6 @@ NFCSTATUS phFriNfc_LlcpTransport_Connectionless_Close(phFriNfc_LlcpTransport_Soc
    pLlcpSocket->eSocket_Type                       = phFriNfc_LlcpTransport_eDefaultType;
    pLlcpSocket->pContext                           = NULL;
    pLlcpSocket->pSocketErrCb                       = NULL;
-   pLlcpSocket->psSocketOption                     = NULL;
    pLlcpSocket->socket_sSap                        = PHFRINFC_LLCP_SAP_DEFAULT;
    pLlcpSocket->socket_dSap                        = PHFRINFC_LLCP_SAP_DEFAULT;
    pLlcpSocket->bSocketRecvPending                 = FALSE;
@@ -111,6 +110,8 @@ NFCSTATUS phFriNfc_LlcpTransport_Connectionless_Close(phFriNfc_LlcpTransport_Soc
    pLlcpSocket->socket_VR                          = 0;
    pLlcpSocket->socket_VRA                         = 0;
 
+   memset(&pLlcpSocket->sSocketOption, 0x00, sizeof(phFriNfc_LlcpTransport_sSocketOptions_t));
+
    if (pLlcpSocket->sServiceName.buffer != NULL) {
        phOsalNfc_FreeMemory(pLlcpSocket->sServiceName.buffer);
    }