Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b621449 authored by Hansong Zhang's avatar Hansong Zhang Committed by android-build-team Robot
Browse files

HIDD: Check descriptor length and increase buffer 

Since maximum descriptor length is 2048, we need to assign 2054 bytes of
buffer for another 6 bytes of data. Also added a const for maximum
descriptor length.

Bug: 113572366
Test: manual
Change-Id: Ie2b25c9e1a9f2019cbc7e6fbecbb08b643c87946
Merged-In: Ie2b25c9e1a9f2019cbc7e6fbecbb08b643c87946
(cherry picked from commit b018c405)
parent 404bcc2a

system/bta/hd/bta_hd_int.h

+1 −1
Original line number Diff line number Diff line
@@ -66,7 +66,7 @@ typedef struct { 
#define BTA_HD_APP_NAME_LEN 50

#define BTA_HD_APP_DESCRIPTION_LEN 50

#define BTA_HD_APP_PROVIDER_LEN 50

#define BTA_HD_APP_DESCRIPTOR_LEN 2048

#define BTA_HD_APP_DESCRIPTOR_LEN HIDD_APP_DESCRIPTOR_LEN



#define BTA_HD_STATE_DISABLED 0x00

#define BTA_HD_STATE_ENABLED 0x01

system/stack/hid/hidd_api.cc

+12 −1
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include "hidd_api.h"

#include "hidd_int.h"

#include "hiddefs.h"

#include "log/log.h"



tHID_DEV_CTB hd_cb;
@@ -293,7 +294,13 @@ tHID_STATUS HID_DevAddRecord(uint32_t handle, char* p_name, char* p_description, 
      uint8_t* p_buf;

      uint8_t seq_len = 4 + desc_len;



      p_buf = (uint8_t*)osi_malloc(2048);

      if (desc_len > HIDD_APP_DESCRIPTOR_LEN) {

        HIDD_TRACE_ERROR("%s: descriptor length = %d, larger than max %d",

                         __func__, desc_len, HIDD_APP_DESCRIPTOR_LEN);

        return HID_ERR_NOT_REGISTERED;

      };



      p_buf = (uint8_t*)osi_malloc(HIDD_APP_DESCRIPTOR_LEN + 6);



      if (p_buf == NULL) {

        HIDD_TRACE_ERROR("%s: Buffer allocation failure for size = 2048 ",
@@ -314,6 +321,10 @@ tHID_STATUS HID_DevAddRecord(uint32_t handle, char* p_name, char* p_description, 
      UINT8_TO_BE_STREAM(p, desc_len);

      ARRAY_TO_BE_STREAM(p, p_desc_data, (int)desc_len);



      if (desc_len > HIDD_APP_DESCRIPTOR_LEN - 6) {

        android_errorWriteLog(0x534e4554, "113572366");

      }



      result &= SDP_AddAttribute(handle, ATTR_ID_HID_DESCRIPTOR_LIST,

                                 DATA_ELE_SEQ_DESC_TYPE, p - p_buf, p_buf);

system/stack/include/hiddefs.h

+2 −0
Original line number Diff line number Diff line
@@ -131,6 +131,8 @@ typedef struct desc_info { 


#define HID_SSR_PARAM_INVALID 0xffff



#define HIDD_APP_DESCRIPTOR_LEN 2048



typedef struct sdp_info {

  char svc_name[HID_MAX_SVC_NAME_LEN];   /*Service Name */

  char svc_descr[HID_MAX_SVC_DESCR_LEN]; /*Service Description*/