report array out of boundary when read HID report reference
descriptor for BLE HID device.
bug:
12208657
Change-Id: Ic60fd7555045f367b4fcd606510f52f60e36995e
while (p_rpt != NULL)
{
+ if (!p_rpt->in_use) break;
+
if (p_rpt->rpt_type == BTA_HH_RPTT_INPUT)
{
/* is battery report */
#endif
}
- if (p_rpt->index < BTA_HH_LE_RPT_MAX)
+ if (p_rpt->index < BTA_HH_LE_RPT_MAX - 1)
p_rpt ++;
-
+ else
+ p_rpt = NULL;
/* read next report reference descriptor */
bta_hh_le_read_rpt_ref_descr(p_dev_cb, p_rpt);