Fix BT HIDH write allocates 1 byte less and returns ok on failed malloc
Fixes:
@@ -241,12 +241,18 @@ static esp_err_t esp_bt_hidh_dev_report_write(esp_hidh_dev_t *dev, size_t map_in
return ESP_FAIL;
}
+#define BT_HDR_HID_DATA_OFFSET 14 //this equals to L2CAP_MIN_OFFSET + 1 (1 byte to hold the HID transaction header)
+
uint8_t *pbuf_data;
- BT_HDR *p_buf = (BT_HDR *)malloc((uint16_t) (len + 14 + sizeof(BT_HDR)));
+ BT_HDR *p_buf = (BT_HDR *)malloc((uint16_t) (len + 1 + BT_HDR_HID_DATA_OFFSET + sizeof(BT_HDR)));
+
+ if (p_buf == NULL) {
+ ESP_LOGE(TAG, "Could not allocate BT_HDR buffer");
+ return ESP_ERR_NO_MEM;
+ }
- if (p_buf != NULL) {
p_buf->len = len + 1;
- p_buf->offset = 14;
+ p_buf->offset = BT_HDR_HID_DATA_OFFSET;
pbuf_data = (uint8_t *) (p_buf + 1) + p_buf->offset;
pbuf_data[0] = report_id;
@@ -263,7 +269,6 @@ static esp_err_t esp_bt_hidh_dev_report_write(esp_hidh_dev_t *dev, size_t map_in
ESP_LOGE(TAG, "Write %s: %s", esp_hid_report_type_str(report_type), s_bta_hh_status_names[dev->status]);
return ESP_FAIL;
}
- }
return ESP_OK;
}
