Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b498988 authored by Hui Peng's avatar Hui Peng Committed by Android Build Coastguard Worker
Browse files

Revert "Fix an OOB bug in bta_hh_co_get_rpt_rsp" 

This reverts commit d2e67f50.

Reason for revert: regression caused in  266585826

Change-Id: I86a5bb0b96332880a2a173ad57b96fb007e3ea83
(cherry picked from commit 2506a98f)
Merged-In: I86a5bb0b96332880a2a173ad57b96fb007e3ea83
parent 29359df3

system/btif/co/bta_hh_co.cc

+4 −5
Original line number Diff line number Diff line
@@ -673,16 +673,15 @@ void bta_hh_co_get_rpt_rsp(uint8_t dev_handle, uint8_t status, uint8_t* p_rpt, 
    ev.type = UHID_FEATURE_ANSWER;

    ev.u.feature_answer.id = *get_rpt_id;

    ev.u.feature_answer.err = status;

    ev.u.feature_answer.size = len - GET_RPT_RSP_OFFSET;

    ev.u.feature_answer.size = len;

    osi_free(get_rpt_id);

    if (len > GET_RPT_RSP_OFFSET) {

      if (len - GET_RPT_RSP_OFFSET > UHID_DATA_MAX) {

    if (len > 0) {

      if (len > UHID_DATA_MAX) {

        APPL_TRACE_WARNING("%s: Report size greater than allowed size",

                           __func__);

        return;

      }

      memcpy(ev.u.feature_answer.data, p_rpt + GET_RPT_RSP_OFFSET,

             len - GET_RPT_RSP_OFFSET);

      memcpy(ev.u.feature_answer.data, p_rpt + GET_RPT_RSP_OFFSET, len);

      uhid_write(p_dev->fd, &ev);

    }

  }