Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aaf8c6e6 authored by Hansong Zhang's avatar Hansong Zhang Committed by android-build-team Robot
Browse files

HIDD: Prevent integer underflow in bta_hd_act 

Bug: 109757435
Bug: 109757168
Bug: 110846194
Bug: 109757986
Test: manual
Change-Id: I80a6f3f931ac7512f1ba801cc5d8de6ac04f3422
(cherry picked from commit 705a9ad5)
parent 1f8435f9

system/bta/hd/bta_hd_act.cc

+29 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ 
#include "bta_sys.h"

#include "btm_api.h"



#include "log/log.h"

#include "osi/include/osi.h"



static void bta_hd_cback(const RawAddress& bd_addr, uint8_t event,
@@ -510,6 +511,10 @@ extern void bta_hd_intr_data_act(tBTA_HD_DATA* p_data) { 
  APPL_TRACE_API("%s", __func__);



  if (bta_hd_cb.use_report_id || bta_hd_cb.boot_mode) {

    if (len < 1) {

      android_errorWriteLog(0x534e4554, "109757986");

      return;

    }

    ret.report_id = *p_buf;



    len--;
@@ -544,15 +549,31 @@ extern void bta_hd_get_report_act(tBTA_HD_DATA* p_data) { 


  APPL_TRACE_API("%s", __func__);



  uint16_t remaining_len = p_msg->len;

  if (remaining_len < 1) {

    android_errorWriteLog(0x534e4554, "109757168");

    return;

  }



  ret.report_type = *p_buf & HID_PAR_REP_TYPE_MASK;

  p_buf++;

  remaining_len--;



  if (bta_hd_cb.use_report_id) {

    if (remaining_len < 1) {

      android_errorWriteLog(0x534e4554, "109757168");

      return;

    }

    ret.report_id = *p_buf;

    p_buf++;

    remaining_len--;

  }



  if (rep_size_follows) {

    if (remaining_len < 2) {

      android_errorWriteLog(0x534e4554, "109757168");

      return;

    }

    ret.buffer_size = *p_buf | (*(p_buf + 1) << 8);

  }
@@ -579,11 +600,19 @@ extern void bta_hd_set_report_act(tBTA_HD_DATA* p_data) { 


  APPL_TRACE_API("%s", __func__);



  if (len < 1) {

    android_errorWriteLog(0x534e4554, "110846194");

    return;

  }

  ret.report_type = *p_buf & HID_PAR_REP_TYPE_MASK;

  p_buf++;

  len--;



  if (bta_hd_cb.use_report_id || bta_hd_cb.boot_mode) {

    if (len < 1) {

      android_errorWriteLog(0x534e4554, "109757435");

      return;

    }

    ret.report_id = *p_buf;



    len--;