alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'bugfix/bt_hidh_write' into 'master'

Browse Source 
Fix BT HIDH write allocates 1 byte less and returns ok on failed malloc

Closes IDFGH-3881

See merge request espressif/esp-idf!10144
This commit is contained in:
Angus Gratton 2020-10-15 06:39:15 +08:00
commit 9f1d9931a7
1 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
components/esp_hid/src/bt_hidh.c
View File

@ -241,28 +241,33 @@ static esp_err_t esp_bt_hidh_dev_report_write(esp_hidh_dev_t *dev, size_t map_in
return ESP_FAIL;
}
#define BT_HDR_HID_DATA_OFFSET 14 //this equals to L2CAP_MIN_OFFSET + 1 (1 byte to hold the HID transaction header)
uint8_t *pbuf_data;
BT_HDR *p_buf = (BT_HDR *)malloc((uint16_t) (len + 14 + sizeof(BT_HDR)));
BT_HDR *p_buf = (BT_HDR *)malloc((uint16_t) (len + 1 + BT_HDR_HID_DATA_OFFSET + sizeof(BT_HDR)));
if (p_buf != NULL) {
p_buf->len = len + 1;
p_buf->offset = 14;
if (p_buf == NULL) {
ESP_LOGE(TAG, "Could not allocate BT_HDR buffer");
return ESP_ERR_NO_MEM;
}
pbuf_data = (uint8_t *) (p_buf + 1) + p_buf->offset;
pbuf_data[0] = report_id;
memcpy(pbuf_data + 1, data, len);
p_buf->len = len + 1;
p_buf->offset = BT_HDR_HID_DATA_OFFSET;
if (report_type == ESP_HID_REPORT_TYPE_OUTPUT) {
p_buf->layer_specific = BTA_HH_RPTT_OUTPUT;
BTA_HhSendData(dev->bt.handle, dev->bda, p_buf);
} else {
BTA_HhSetReport(dev->bt.handle, report_type, p_buf);
WAIT_DEV(dev);
}
if (dev->status) {
ESP_LOGE(TAG, "Write %s: %s", esp_hid_report_type_str(report_type), s_bta_hh_status_names[dev->status]);
return ESP_FAIL;
}
pbuf_data = (uint8_t *) (p_buf + 1) + p_buf->offset;
pbuf_data[0] = report_id;
memcpy(pbuf_data + 1, data, len);
if (report_type == ESP_HID_REPORT_TYPE_OUTPUT) {
p_buf->layer_specific = BTA_HH_RPTT_OUTPUT;
BTA_HhSendData(dev->bt.handle, dev->bda, p_buf);
} else {
BTA_HhSetReport(dev->bt.handle, report_type, p_buf);
WAIT_DEV(dev);
}
if (dev->status) {
ESP_LOGE(TAG, "Write %s: %s", esp_hid_report_type_str(report_type), s_bta_hh_status_names[dev->status]);
return ESP_FAIL;
}
return ESP_OK;
}