Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 383e826d authored by Hemant Gupta's avatar Hemant Gupta Committed by Myles Watson
Browse files

HID: Fix issues reported by Static Analysis Tool 

- Update error checking condition in bta_hh_le_co_cache_load API
  to return if either num of report is 0 or if length of report is
  less than size of report cache structure.

- Memset the report descriptor before use to properly initialize variables
  not updated in function.

Test: builds, hid functionality works fine

Bug: 35013844
Change-Id: Ie0347307d7536f18bf8f32a2dfeda593a41933bf
parent b746f52c

system/btif/co/bta_hh_co.cc

+1 −1
Original line number Diff line number Diff line
@@ -562,7 +562,7 @@ tBTA_HH_RPT_CACHE_ENTRY* bta_hh_le_co_cache_load(const RawAddress& remote_bda, 
  const char* bdstr = addrstr.c_str();



  size_t len = btif_config_get_bin_length(bdstr, "HidReport");

  if (!p_num_rpt && len < sizeof(tBTA_HH_RPT_CACHE_ENTRY)) return NULL;

  if (!p_num_rpt || len < sizeof(tBTA_HH_RPT_CACHE_ENTRY)) return NULL;



  if (len > sizeof(sReportCache)) len = sizeof(sReportCache);

  btif_config_get_bin(bdstr, "HidReport", (uint8_t*)sReportCache, &len);

system/btif/src/btif_hh.cc

+2 −0
Original line number Diff line number Diff line
@@ -503,6 +503,7 @@ void btif_hh_remove_device(RawAddress bd_addr) { 


bool btif_hh_copy_hid_info(tBTA_HH_DEV_DSCP_INFO* dest,

                           tBTA_HH_DEV_DSCP_INFO* src) {

  memset(dest, 0, sizeof(tBTA_HH_DEV_DSCP_INFO));

  dest->descriptor.dl_len = 0;

  if (src->descriptor.dl_len > 0) {

    dest->descriptor.dsc_list = (uint8_t*)osi_malloc(src->descriptor.dl_len);
@@ -1351,6 +1352,7 @@ static bt_status_t set_info(RawAddress* bd_addr, bthh_hid_info_t hid_info) { 
    return BT_STATUS_FAIL;

  }



  memset(&dscp_info, 0, sizeof(dscp_info));

  dscp_info.vendor_id = hid_info.vendor_id;

  dscp_info.product_id = hid_info.product_id;

  dscp_info.version = hid_info.version;