OSDN Git Service

DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
[android-x86/system-bt.git] / bta / hh / bta_hh_act.c
index 8ec2698..7d0e5bd 100644 (file)
@@ -26,6 +26,7 @@
 
 #if defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE)
 
+#include <log/log.h>
 #include <string.h>
 
 #include "bta_sys.h"
@@ -165,15 +166,15 @@ void bta_hh_disc_cmpl(void)
     tBTA_HH_STATUS  status = BTA_HH_OK;
 
     /* Deregister with lower layer */
-    if (HID_HostDeregister()!= HID_SUCCESS)
+    if (HID_HostDeregister() != HID_SUCCESS)
         status = BTA_HH_ERR;
 
 #if (BTA_HH_LE_INCLUDED == TRUE)
     bta_hh_le_deregister();
-    return;
-#endif
-
+    UNUSED(status);
+#else
     bta_hh_cleanup_disable(status);
+#endif
 }
 
 /*******************************************************************************
@@ -189,7 +190,7 @@ static void bta_hh_sdp_cback(UINT16 result, UINT16 attr_mask,
                                   tHID_DEV_SDP_INFO *sdp_rec )
 {
     tBTA_HH_DEV_CB     *p_cb = bta_hh_cb.p_cur;
-    UINT8              hdl;
+    UINT8              hdl = 0;
     tBTA_HH_STATUS    status = BTA_HH_ERR_SDP;
 
     /* make sure sdp succeeded and hh has not been disabled */
@@ -200,7 +201,7 @@ static void bta_hh_sdp_cback(UINT16 result, UINT16 attr_mask,
             attr_mask |= HID_SEC_REQUIRED;
 
 #if BTA_HH_DEBUG
-        APPL_TRACE_EVENT4("bta_hh_sdp_cback: p_cb: %d result 0x%02x, \
+        APPL_TRACE_EVENT("bta_hh_sdp_cback: p_cb: %d result 0x%02x, \
                             attr_mask 0x%02x, handle %x", \
                             p_cb, result, attr_mask,p_cb->hid_handle);
 #endif
@@ -250,7 +251,7 @@ static void bta_hh_sdp_cback(UINT16 result, UINT16 attr_mask,
     }
 
     /* free disc_db when SDP is completed */
-    utl_freebuf((void **)&bta_hh_cb.p_disc_db);
+    osi_free_and_reset((void **)&bta_hh_cb.p_disc_db);
 
     /* send SDP_CMPL_EVT into state machine */
     bta_hh_sm_execute(p_cb, BTA_HH_SDP_CMPL_EVT, (tBTA_HH_DATA *)&status);
@@ -273,7 +274,7 @@ static void bta_hh_di_sdp_cback(UINT16 result)
     tSDP_DI_GET_RECORD  di_rec;
     tHID_STATUS ret;
 #if BTA_HH_DEBUG
-    APPL_TRACE_EVENT2("bta_hh_di_sdp_cback: p_cb: %d result 0x%02x", p_cb, result);
+    APPL_TRACE_EVENT("bta_hh_di_sdp_cback: p_cb: %d result 0x%02x", p_cb, result);
 #endif
 
     /* if DI record does not exist on remote device, vendor_id in tBTA_HH_DEV_DSCP_INFO will be
@@ -306,16 +307,15 @@ static void bta_hh_di_sdp_cback(UINT16 result)
         else
         {
 #if BTA_HH_DEBUG
-            APPL_TRACE_DEBUG1 ("bta_hh_di_sdp_cback:  HID_HostGetSDPRecord failed: Status 0x%2x",
+            APPL_TRACE_DEBUG ("bta_hh_di_sdp_cback:  HID_HostGetSDPRecord failed: Status 0x%2x",
                                ret);
 #endif
         }
     }
 
 
-    if (status != BTA_HH_OK)
-    {
-        utl_freebuf((void **)&bta_hh_cb.p_disc_db);
+    if (status != BTA_HH_OK) {
+        osi_free_and_reset((void **)&bta_hh_cb.p_disc_db);
         /* send SDP_CMPL_EVT into state machine */
         bta_hh_sm_execute(p_cb, BTA_HH_SDP_CMPL_EVT, (tBTA_HH_DATA *)&status);
     }
@@ -358,7 +358,7 @@ void bta_hh_start_sdp(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
     {
         status = BTA_HH_OK;
 #if BTA_HH_DEBUG
-        APPL_TRACE_DEBUG0("bta_hh_start_sdp:: skip SDP for known devices");
+        APPL_TRACE_DEBUG("bta_hh_start_sdp:: skip SDP for known devices");
 #endif
         if (p_cb->hid_handle == BTA_HH_INVALID_HANDLE)
         {
@@ -384,30 +384,21 @@ void bta_hh_start_sdp(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
     /* GetSDPRecord. at one time only one SDP precedure can be active */
     else if (!bta_hh_cb.p_disc_db)
     {
-        bta_hh_cb.p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(p_bta_hh_cfg->sdp_db_size);
-
-        if (bta_hh_cb.p_disc_db == NULL)
-        {
-            status = BTA_HH_ERR_NO_RES;
-        }
-        else
-        {
-            bta_hh_cb.p_cur = p_cb;
-            /* do DI discovery first */
-            if (SDP_DiDiscover(p_data->api_conn.bd_addr,
-                                         bta_hh_cb.p_disc_db,
-                                         p_bta_hh_cfg->sdp_db_size,
-                                         bta_hh_di_sdp_cback) != SDP_SUCCESS)
-            {
+        bta_hh_cb.p_disc_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_hh_cfg->sdp_db_size);
+        bta_hh_cb.p_cur = p_cb;
+        /* do DI discovery first */
+        if (SDP_DiDiscover(p_data->api_conn.bd_addr,
+                           bta_hh_cb.p_disc_db,
+                           p_bta_hh_cfg->sdp_db_size,
+                           bta_hh_di_sdp_cback) != SDP_SUCCESS) {
 #if BTA_HH_DEBUG
-                APPL_TRACE_DEBUG1 ("bta_hh_start_sdp:  SDP_DiDiscover failed: \
+            APPL_TRACE_DEBUG("bta_hh_start_sdp:  SDP_DiDiscover failed: \
                     Status 0x%2X",status);
 #endif
-                status = BTA_HH_ERR_SDP;
-                utl_freebuf((void **)&bta_hh_cb.p_disc_db);
-            }
-            else
-                status = BTA_HH_OK;
+            status = BTA_HH_ERR_SDP;
+            osi_free_and_reset((void **)&bta_hh_cb.p_disc_db);
+        } else {
+            status = BTA_HH_OK;
         }
     }
 
@@ -434,7 +425,7 @@ void bta_hh_sdp_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
     tBTA_HH_STATUS          status = p_data->status;
 
 #if BTA_HH_DEBUG
-    APPL_TRACE_DEBUG1 ("bta_hh_sdp_cmpl:  status 0x%2X",p_data->status);
+    APPL_TRACE_DEBUG ("bta_hh_sdp_cmpl:  status 0x%2X",p_data->status);
 #endif
 
     /* initialize call back data */
@@ -453,20 +444,29 @@ void bta_hh_sdp_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
             HID_HostSetSecurityLevel("", p_cb->sec_mask);
 
             /* open HID connection */
-            if ((ret = HID_HostOpenDev (p_cb->hid_handle)) != HID_SUCCESS)
+            ret = HID_HostOpenDev (p_cb->hid_handle);
+            APPL_TRACE_DEBUG ("%s: HID_HostOpenDev returned=%d", __func__, ret);
+            if (ret == HID_SUCCESS || ret == HID_ERR_ALREADY_CONN)
+            {
+                status = BTA_HH_OK;
+            }
+            else if (ret == HID_ERR_CONN_IN_PROCESS)
+            {
+                /* Connection already in progress, return from here, SDP
+                 * will be performed after connection is completed.
+                 */
+                APPL_TRACE_DEBUG ("%s: connection already in progress", __func__);
+                return;
+            }
+            else
             {
 #if BTA_HH_DEBUG
-                APPL_TRACE_DEBUG1 ("bta_hh_sdp_cmpl:  HID_HostOpenDev failed: \
-                    Status 0x%2X",ret);
+                APPL_TRACE_DEBUG ("%s: HID_HostOpenDev failed: Status 0x%2X", __func__, ret);
 #endif
                 /* open fail, remove device from management device list */
                 HID_HostRemoveDev( p_cb->hid_handle);
                 status = BTA_HH_ERR;
             }
-            else
-            {
-                status = BTA_HH_OK;
-            }
         }
         else /* incoming connection SDP finish */
         {
@@ -483,7 +483,7 @@ void bta_hh_sdp_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
         if ((status == BTA_HH_ERR_SDP) &&
            (p_cb->incoming_conn) &&(p_cb->app_id == 0))
         {
-            APPL_TRACE_DEBUG1 ("bta_hh_sdp_cmpl:SDP failed for  incoming conn :hndl %d",
+            APPL_TRACE_DEBUG ("bta_hh_sdp_cmpl:SDP failed for  incoming conn :hndl %d",
                                 p_cb->incoming_hid_handle);
             HID_HostRemoveDev( p_cb->incoming_hid_handle);
         }
@@ -625,7 +625,7 @@ void bta_hh_open_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
                         p_cb->hid_handle;
 
 #if BTA_HH_DEBUG
-    APPL_TRACE_EVENT1 ("bta_hh_open_act:  Device[%d] connected", dev_handle);
+    APPL_TRACE_EVENT ("bta_hh_open_act:  Device[%d] connected", dev_handle);
 #endif
 
     /* SDP has been done */
@@ -668,7 +668,7 @@ void bta_hh_data_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
     bta_hh_co_data((UINT8)p_data->hid_cback.hdr.layer_specific, p_rpt, pdata->len,
                     p_cb->mode, p_cb->sub_class, p_cb->dscp_info.ctry_code, p_cb->addr, p_cb->app_id);
 
-    utl_freebuf((void **)&pdata);
+    osi_free_and_reset((void **)&pdata);
 }
 
 
@@ -689,7 +689,7 @@ void bta_hh_handsk_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
     tBTA_HH_CONN    conn ;
 
 #if BTA_HH_DEBUG
-    APPL_TRACE_DEBUG2("HANDSHAKE received for: event = %s data= %d",
+    APPL_TRACE_DEBUG("HANDSHAKE received for: event = %s data= %d",
         bta_hh_get_w4_event(p_cb->w4_evt), p_data->hid_cback.data);
 #endif
 
@@ -737,7 +737,7 @@ void bta_hh_handsk_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
 
         default:
             /* unknow transaction handshake response */
-            APPL_TRACE_DEBUG0("unknown transaction type");
+            APPL_TRACE_DEBUG("unknown transaction type");
             break;
     }
 
@@ -762,9 +762,15 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
     tBTA_HH_HSDATA    hs_data;
 
 #if BTA_HH_DEBUG
-    APPL_TRACE_DEBUG1("Ctrl DATA received w4: event[%s]",
+    APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",
                         bta_hh_get_w4_event(p_cb->w4_evt));
 #endif
+    if (pdata->len == 0) {
+        android_errorWriteLog(0x534e4554, "116108738");
+        p_cb->w4_evt = 0;
+        osi_free_and_reset((void**)&pdata);
+        return;
+    }
     hs_data.status  = BTA_HH_OK;
     hs_data.handle  = p_cb->hid_handle;
 
@@ -781,7 +787,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
         hs_data.rsp_data.proto_mode = ((*data) == HID_PAR_PROTOCOL_REPORT)? \
                     BTA_HH_PROTO_RPT_MODE : BTA_HH_PROTO_BOOT_MODE;
 #if BTA_HH_DEBUG
-        APPL_TRACE_DEBUG1("GET_PROTOCOL Mode = [%s]",
+        APPL_TRACE_DEBUG("GET_PROTOCOL Mode = [%s]",
             (hs_data.rsp_data.proto_mode == BTA_HH_PROTO_RPT_MODE)? "Report" : "Boot");
 #endif
         break;
@@ -794,7 +800,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
         /* fall through */
     default:
 #if BTA_HH_DEBUG
-        APPL_TRACE_DEBUG1("invalid  transaction type for DATA payload: 4_evt[%s]",
+        APPL_TRACE_DEBUG("invalid  transaction type for DATA payload: 4_evt[%s]",
                         bta_hh_get_w4_event(p_cb->w4_evt));
 #endif
         break;
@@ -807,7 +813,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
     (* bta_hh_cb.p_cback)(p_cb->w4_evt, (tBTA_HH *)&hs_data);
 
     p_cb->w4_evt = 0;
-    utl_freebuf((void **)&pdata);
+    osi_free_and_reset((void **)&pdata);
 
 }
 
@@ -850,6 +856,9 @@ void bta_hh_open_failure(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
         bta_hh_disc_cmpl();
     }
 
+    /* Error in opening hid connection, reset flags */
+    p_cb->incoming_conn = FALSE;
+    p_cb->incoming_hid_handle = BTA_HH_INVALID_HANDLE;
 }
 
 /*******************************************************************************
@@ -1060,7 +1069,7 @@ void bta_hh_maint_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
         break;
 
     default:
-        APPL_TRACE_DEBUG0("invalid command");
+        APPL_TRACE_DEBUG("invalid command");
         break;
     }
 
@@ -1104,7 +1113,7 @@ void bta_hh_write_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
                        p_data->api_sndcmd.rpt_id,
                        p_data->api_sndcmd.p_data) != HID_SUCCESS)
     {
-        APPL_TRACE_ERROR0("HID_HostWriteDev Error ");
+        APPL_TRACE_ERROR("HID_HostWriteDev Error ");
         cbdata.status = BTA_HH_ERR;
 
         if (p_data->api_sndcmd.t_type != HID_TRANS_CONTROL &&
@@ -1143,7 +1152,7 @@ void bta_hh_write_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
         /* currently not expected */
         case HID_TRANS_DATAC:
         default:
-            APPL_TRACE_DEBUG1("bta_hh_write_dev_act:: cmd type = %d",
+            APPL_TRACE_DEBUG("bta_hh_write_dev_act:: cmd type = %d",
                             p_data->api_sndcmd.t_type);
             break;
         }
@@ -1185,12 +1194,11 @@ void bta_hh_write_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
 static void bta_hh_cback (UINT8 dev_handle, BD_ADDR addr, UINT8 event,
                         UINT32 data, BT_HDR *pdata)
 {
-    tBTA_HH_CBACK_DATA    *p_buf = NULL;
     UINT16  sm_event = BTA_HH_INVALID_EVT;
     UINT8   xx = 0;
 
 #if BTA_HH_DEBUG
-    APPL_TRACE_DEBUG1("bta_hh_cback::HID_event [%s]", bta_hh_hid_event_name(event));
+    APPL_TRACE_DEBUG("bta_hh_cback::HID_event [%s]", bta_hh_hid_event_name(event));
 #endif
 
     switch (event)
@@ -1215,7 +1223,7 @@ static void bta_hh_cback (UINT8 dev_handle, BD_ADDR addr, UINT8 event,
     case HID_HDEV_EVT_INTR_DATC:
     case HID_HDEV_EVT_CTRL_DATC:
         /* Unhandled events: Free buffer for DATAC */
-        utl_freebuf((void **)&pdata);
+        osi_free_and_reset((void **)&pdata);
         break;
     case HID_HDEV_EVT_VC_UNPLUG:
         for (xx = 0; xx < BTA_HH_MAX_DEVICE; xx++)
@@ -1229,20 +1237,20 @@ static void bta_hh_cback (UINT8 dev_handle, BD_ADDR addr, UINT8 event,
         break;
     }
 
-    if (sm_event != BTA_HH_INVALID_EVT &&
-        (p_buf = (tBTA_HH_CBACK_DATA *)GKI_getbuf(sizeof(tBTA_HH_CBACK_DATA) +
-                    sizeof(BT_HDR))) != NULL)
-    {
-        p_buf->hdr.event  = sm_event;
+    if (sm_event != BTA_HH_INVALID_EVT) {
+        tBTA_HH_CBACK_DATA *p_buf =
+            (tBTA_HH_CBACK_DATA *)osi_malloc(sizeof(tBTA_HH_CBACK_DATA) +
+                                             sizeof(BT_HDR));
+        p_buf->hdr.event = sm_event;
         p_buf->hdr.layer_specific = (UINT16)dev_handle;
-        p_buf->data       = data;
+        p_buf->data = data;
         bdcpy(p_buf->addr, addr);
-        p_buf->p_data     = pdata;
+        p_buf->p_data = pdata;
 
         bta_sys_sendmsg(p_buf);
     }
-
 }
+
 /*******************************************************************************
 **
 ** Function         bta_hh_get_trans_status