Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d33ed8e1 authored by Zhihai Xu's avatar Zhihai Xu
Browse files

read report array out of boundary for BLE HID device. 

report array out of boundary when read HID report reference
descriptor for BLE HID device.

bug:12208657
Change-Id: Ic60fd7555045f367b4fcd606510f52f60e36995e
parent e9967ae9

system/bta/hh/bta_hh_le.c

+5 −2
Original line number Diff line number Diff line
@@ -639,6 +639,8 @@ void bta_hh_le_read_rpt_ref_descr(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_LE_RPT *p_rp 


    while (p_rpt != NULL)

    {

        if (!p_rpt->in_use) break;



        if (p_rpt->rpt_type == BTA_HH_RPTT_INPUT)

        {

            /* is battery report */
@@ -719,9 +721,10 @@ void bta_hh_le_save_rpt_ref(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_LE_RPT *p_rpt, 
#endif

    }



    if (p_rpt->index < BTA_HH_LE_RPT_MAX)

    if (p_rpt->index < BTA_HH_LE_RPT_MAX - 1)

        p_rpt ++;



    else

        p_rpt = NULL;

    /* read next report reference descriptor  */

    bta_hh_le_read_rpt_ref_descr(p_dev_cb, p_rpt);