espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-08-01 19:54:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix BT HIDH write allocates 1 byte less and returns ok on failed malloc

Browse Source 
Fixes: https://github.com/espressif/esp-idf/issues/5781
This commit is contained in:
me-no-dev
2020-08-24 21:56:34 +03:00
parent f10f27c01a
commit d535b8c458
1 changed files with 23 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
components/esp_hid/src/bt_hidh.c
View File

@@ -241,12 +241,18 @@ static esp_err_t esp_bt_hidh_dev_report_write(esp_hidh_dev_t *dev, size_t map_in
return ESP_FAIL;
}
uint8_t *pbuf_data;
BT_HDR *p_buf = (BT_HDR *)malloc((uint16_t) (len + 14 + sizeof(BT_HDR)));
#define BT_HDR_HID_DATA_OFFSET 14 //this equals to L2CAP_MIN_OFFSET + 1 (1 byte to hold the HID transaction header)
uint8_t *pbuf_data;
BT_HDR *p_buf = (BT_HDR *)malloc((uint16_t) (len + 1 + BT_HDR_HID_DATA_OFFSET + sizeof(BT_HDR)));
if (p_buf == NULL) {
ESP_LOGE(TAG, "Could not allocate BT_HDR buffer");
return ESP_ERR_NO_MEM;
}
if (p_buf != NULL) {
p_buf->len = len + 1;
p_buf->offset = 14;
p_buf->offset = BT_HDR_HID_DATA_OFFSET;
pbuf_data = (uint8_t *) (p_buf + 1) + p_buf->offset;
pbuf_data[0] = report_id;
@@ -263,7 +269,6 @@ static esp_err_t esp_bt_hidh_dev_report_write(esp_hidh_dev_t *dev, size_t map_in
ESP_LOGE(TAG, "Write %s: %s", esp_hid_report_type_str(report_type), s_bta_hh_status_names[dev->status]);
return ESP_FAIL;
}
}
return ESP_OK;
}