From: Zhihai Xu <zhihaixu@google.com>
Date: Mon, 21 Apr 2014 19:05:42 +0000 (+0530)
Subject: HID: Use dynamic memory while sending report
X-Git-Tag: android-x86-7.1-r1~1809
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=f11d21fa60be8a2cd072968bf5e1bb23ce5caabf;p=android-x86%2Fsystem-bt.git

HID: Use dynamic memory while sending report

This patch uses dynamic memory allocation while sending HID output data to
remote device depending on size of data to be sent. Without this patch
fixed size static buffer of 200 bytes was being used for sending data to
remote device, which was resulting in crash in case data size to be sent
to remote device was greater than 200 bytes.

CL from qcom(Hemant Gupta)
Change-Id: Icc8cd4a4ecfd4bc30cbf848a7c865fcf9308ddf8
---

diff --git a/btif/src/btif_hh.c b/btif/src/btif_hh.c
index f296c611e..535738749 100644
--- a/btif/src/btif_hh.c
+++ b/btif/src/btif_hh.c
@@ -1636,11 +1636,18 @@ static bt_status_t set_report (bt_bdaddr_t *bd_addr, bthh_report_type_t reportTy
     }
     else {
         int    hex_bytes_filled;
-        UINT8  hexbuf[200];
+        UINT8  *hexbuf;
         UINT16 len = (strlen(report) + 1) / 2;
 
+        hexbuf = GKI_getbuf(len);
+        if (hexbuf == NULL) {
+            BTIF_TRACE_ERROR2("%s: Error, failed to allocate RPT buffer, len = %d",
+                __FUNCTION__, len);
+            return BT_STATUS_FAIL;
+        }
+
         /* Build a SetReport data buffer */
-        memset(hexbuf, 0, 200);
+        memset(hexbuf, 0, len);
         //TODO
         hex_bytes_filled = ascii_2_hex(report, len, hexbuf);
         BTIF_TRACE_DEBUG1("Hex bytes filled, hex value: %d", hex_bytes_filled);
@@ -1649,11 +1656,15 @@ static bt_status_t set_report (bt_bdaddr_t *bd_addr, bthh_report_type_t reportTy
             if (p_buf == NULL) {
                 BTIF_TRACE_ERROR2("%s: Error, failed to allocate RPT buffer, len = %d",
                                   __FUNCTION__, hex_bytes_filled);
+                GKI_freebuf(hexbuf);
                 return BT_STATUS_FAIL;
             }
             BTA_HhSetReport(p_dev->dev_handle, reportType, p_buf);
+            GKI_freebuf(hexbuf);
+            return BT_STATUS_SUCCESS;
         }
-        return BT_STATUS_SUCCESS;
+        GKI_freebuf(hexbuf);
+        return BT_STATUS_FAIL;
     }
 }