Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 629d8982 authored by William Escande's avatar William Escande Committed by Automerger Merge Worker
Browse files

Merge "Revert "Fix a OOB bug in bta_hh_co_get_rpt_rsp"" into tm-dev am:... 

Merge "Revert "Fix a OOB bug in bta_hh_co_get_rpt_rsp"" into tm-dev am: 261b9b8d am: dd201368 am: b39defe3

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22625319



Change-Id: Icc7891904636dba765536f714ff7a9cf48bfba35
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents a28cce98 b39defe3

system/btif/co/bta_hh_co.cc

+3 −4
Original line number Diff line number Diff line
@@ -685,14 +685,13 @@ void bta_hh_co_get_rpt_rsp(uint8_t dev_handle, uint8_t status, uint8_t* p_rpt, 
    ev.u.feature_answer.err = status;

    ev.u.feature_answer.size = len;

    osi_free(get_rpt_id);



    if (len >= GET_RPT_RSP_OFFSET) {

      if (len - GET_RPT_RSP_OFFSET > UHID_DATA_MAX) {

    if (len > 0) {

      if (len > UHID_DATA_MAX) {

        APPL_TRACE_WARNING("%s: Report size greater than allowed size",

                           __func__);

        return;

      }

      memcpy(ev.u.feature_answer.data, p_rpt + GET_RPT_RSP_OFFSET, len - GET_RPT_RSP_OFFSET);

      memcpy(ev.u.feature_answer.data, p_rpt + GET_RPT_RSP_OFFSET, len);

      uhid_write(p_dev->fd, &ev);

    }

  }