Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d28b14f authored by Sumit Deshmukh's avatar Sumit Deshmukh
Browse files

HID [ASan]: Fix for heap buffer overflow issue. 

Reproducibility: 100% (with ASan enabled)

Use Case: Unpair HID device.

Issue: Fatal issue with reason "heap-buffer-overflow"

Root cause:
Number of arguments supplied did not match with format
specifiers which could lead to unpredicted behavior.

Fix:
Provide equal number of arguments to mentioned format
specifiers.

Test: Tested by unpairing HID device and issue is not
      reproducible when ASan is enabled.

Fixes: 145188301

Change-Id: I158a4b07dc03d18f83256cdef187033bfdee4b96
parent 0be2268e

system/btif/src/btif_hh.cc

+4 −2
Original line number Diff line number Diff line
@@ -537,7 +537,8 @@ bt_status_t btif_hh_virtual_unplug(const RawAddress* bd_addr) { 
  p_dev = btif_hh_find_dev_by_bda(*bd_addr);

  if ((p_dev != NULL) && (p_dev->dev_status == BTHH_CONN_STATE_CONNECTED) &&

      (p_dev->attr_mask & HID_VIRTUAL_CABLE)) {

    BTIF_TRACE_DEBUG("%s Sending BTA_HH_CTRL_VIRTUAL_CABLE_UNPLUG", __func__);

    BTIF_TRACE_DEBUG("%s: Sending BTA_HH_CTRL_VIRTUAL_CABLE_UNPLUG for: %s", __func__,

                     bd_addr->ToString().c_str());

    /* start the timer */

    btif_hh_start_vup_timer(bd_addr);

    p_dev->local_vup = true;
@@ -545,7 +546,8 @@ bt_status_t btif_hh_virtual_unplug(const RawAddress* bd_addr) { 
    return BT_STATUS_SUCCESS;

  } else if ((p_dev != NULL) &&

             (p_dev->dev_status == BTHH_CONN_STATE_CONNECTED)) {

    BTIF_TRACE_ERROR("%s: Virtual unplug not suported, disconnecting device");

    BTIF_TRACE_ERROR("%s: Virtual unplug not suported, disconnecting device: %s",

                     __func__, bd_addr->ToString().c_str());

    /* start the timer */

    btif_hh_start_vup_timer(bd_addr);

    p_dev->local_vup = true;