DO NOT MERGE HID Host: Check L2CAP packet data length

[android-x86/system-bt.git] / stack / hid / hidh_conn.c

diff --git a/stack/hid/hidh_conn.c b/stack/hid/hidh_conn.c
index d1cb700..39ba8bc 100644 (file)
--- a/stack/hid/hidh_conn.c
+++ b/stack/hid/hidh_conn.c
@@ -29,6 +29,7 @@
 
 #include "bt_common.h"
 #include "bt_types.h"
+#include "log/log.h"
 
 #include "l2cdefs.h"
 #include "l2c_api.h"
@@ -45,6 +46,9 @@
 
 #include "osi/include/osi.h"
 
+
+extern fixed_queue_t *btu_general_alarm_queue;
+
 static UINT8 find_conn_by_cid (UINT16 cid);
 static void hidh_conn_retry (UINT8 dhandle);
 
@@ -292,19 +296,24 @@ static void hidh_l2cif_connect_ind (BD_ADDR  bd_addr, UINT16 l2cap_cid, UINT16 p
                        psm, l2cap_cid);
 }
 
+void hidh_process_repage_timer_timeout(void *data)
+{
+  uint8_t dhandle = PTR_TO_UINT(data);
+  hidh_try_repage(dhandle);
+}
+
 /*******************************************************************************
 **
-** Function         hidh_proc_repage_timeout
+** Function         hidh_try_repage
 **
-** Description      This function handles timeout (to page device).
+** Description      This function processes timeout (to page device).
 **
 ** Returns          void
 **
 *******************************************************************************/
-void hidh_proc_repage_timeout(timer_entry_t *p_te)
+void hidh_try_repage(UINT8 dhandle)
 {
     tHID_HOST_DEV_CTB *device;
-    UINT8 dhandle = PTR_TO_UINT(p_te->param);
 
     hidh_conn_initiate(dhandle);
 
@@ -662,8 +671,10 @@ static void hidh_l2cif_disconnect_ind (UINT16 l2cap_cid, BOOLEAN ack_needed)
             (hh_cb.devices[dhandle].attr_mask & HID_NORMALLY_CONNECTABLE))
         {
             hh_cb.devices[dhandle].conn_tries = 0;
-            hh_cb.devices[dhandle].conn.timer_entry.param = UINT_TO_PTR(dhandle);
-            btu_start_timer (&(hh_cb.devices[dhandle].conn.timer_entry), BTU_TTYPE_HID_HOST_REPAGE_TO, HID_HOST_REPAGE_WIN);
+            period_ms_t interval_ms = HID_HOST_REPAGE_WIN * 1000;
+            alarm_set_on_queue(hh_cb.devices[dhandle].conn.process_repage_timer,
+                               interval_ms, hidh_process_repage_timer_timeout,
+                               UINT_TO_PTR(dhandle), btu_general_alarm_queue);
             hh_cb.callback( dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, disc_res, NULL);
         }
         else
@@ -806,10 +817,17 @@ static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
     if (p_hcon == NULL)
     {
         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP data, unknown CID: 0x%x", l2cap_cid);
-        osi_freebuf (p_msg);
+        osi_free(p_msg);
         return;
     }
 
+    if (p_msg->len < 1)
+    {
+        HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP data, invalid length");
+        osi_free(p_msg);
+        android_errorWriteLog(0x534e4554, "80493272");
+        return;
+    }
 
     ttype    = HID_GET_TRANS_FROM_HDR(*p_data);
     param    = HID_GET_PARAM_FROM_HDR(*p_data);
@@ -824,7 +842,7 @@ static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
     {
     case HID_TRANS_HANDSHAKE:
         hh_cb.callback(dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_HANDSHAKE, param, NULL);
-        osi_freebuf (p_msg);
+        osi_free(p_msg);
         break;
 
     case HID_TRANS_CONTROL:
@@ -839,7 +857,7 @@ static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
         default:
             break;
         }
-        osi_freebuf (p_msg);
+        osi_free(p_msg);
         break;
 
 
@@ -856,10 +874,9 @@ static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
         break;
 
     default:
-        osi_freebuf (p_msg);
+        osi_free(p_msg);
         break;
     }
-
 }
 
 /*******************************************************************************
@@ -887,16 +904,14 @@ tHID_STATUS hidh_conn_snd_data (UINT8 dhandle, UINT8 trans_type, UINT8 param,
 
     if (!BTM_IsAclConnectionUp(hh_cb.devices[dhandle].addr, BT_TRANSPORT_BR_EDR))
     {
-        if (buf)
-            osi_freebuf ((void *)buf);
-        return( HID_ERR_NO_CONNECTION );
+        osi_free(buf);
+        return HID_ERR_NO_CONNECTION;
     }
 
     if (p_hcon->conn_flags & HID_CONN_FLAGS_CONGESTED)
     {
-        if (buf)
-            osi_freebuf ((void *)buf);
-        return( HID_ERR_CONGESTED );
+        osi_free(buf);
+        return HID_ERR_CONGESTED;
     }
 
     switch( trans_type )
@@ -928,9 +943,7 @@ tHID_STATUS hidh_conn_snd_data (UINT8 dhandle, UINT8 trans_type, UINT8 param,
     {
         if ( buf == NULL || blank_datc )
         {
-            p_buf = (BT_HDR *)osi_getbuf(buf_size);
-            if (p_buf == NULL)
-                return (HID_ERR_NO_RESOURCES);
+            p_buf = (BT_HDR *)osi_malloc(buf_size);
 
             p_buf->offset = L2CAP_MIN_OFFSET;
             seg_req = FALSE;
@@ -940,9 +953,7 @@ tHID_STATUS hidh_conn_snd_data (UINT8 dhandle, UINT8 trans_type, UINT8 param,
         }
         else if ( (buf->len > (p_hcon->rem_mtu_size - 1)))
         {
-            p_buf = (BT_HDR *)osi_getbuf(buf_size);
-            if (p_buf == NULL)
-                return (HID_ERR_NO_RESOURCES);
+            p_buf = (BT_HDR *)osi_malloc(buf_size);
 
             p_buf->offset = L2CAP_MIN_OFFSET;
             seg_req = TRUE;
@@ -1097,10 +1108,12 @@ static void hidh_conn_retry(  UINT8 dhandle )
     tHID_HOST_DEV_CTB *p_dev = &hh_cb.devices[dhandle];
 
     p_dev->conn.conn_state = HID_CONN_STATE_UNUSED;
-    p_dev->conn.timer_entry.param = UINT_TO_PTR(dhandle);
 #if (HID_HOST_REPAGE_WIN > 0)
-    btu_start_timer (&(p_dev->conn.timer_entry), BTU_TTYPE_HID_HOST_REPAGE_TO, HID_HOST_REPAGE_WIN);
+    period_ms_t interval_ms = HID_HOST_REPAGE_WIN * 1000;
+    alarm_set_on_queue(p_dev->conn.process_repage_timer,
+                       interval_ms, hidh_process_repage_timer_timeout,
+                       UINT_TO_PTR(dhandle), btu_general_alarm_queue);
 #else
-    hidh_proc_repage_timeout( &(p_dev->conn.timer_entry) );
+    hidh_process_repage_process(dhandle);
 #endif
 }