Hi Szymon,
On Mon, Dec 16, 2013 at 4:37 PM, Szymon Janc <szymon.janc@xxxxxxxxx> wrote:
> Make it use VLA for req buffer. This makes function simpler and also
> fix cutting req to 255 bytes (req_len was uint8_t)
> ---
> android/hidhost.c | 17 +++++------------
> 1 file changed, 5 insertions(+), 12 deletions(-)
>
> diff --git a/android/hidhost.c b/android/hidhost.c
> index 0e0391a..76322af 100644
> --- a/android/hidhost.c
> +++ b/android/hidhost.c
> @@ -156,29 +156,22 @@ static void hid_device_free(struct hid_device *dev)
> static void handle_uhid_output(struct hid_device *dev,
> struct uhid_output_req *output)
> {
> - int fd, i;
> - uint8_t *req = NULL;
> - uint8_t req_size = 0;
> + int fd;
> + unsigned int i;
> + uint8_t req[1 + (output->size / 2)];
Im not a fan of VLA and Ive seem even some static analyzer that would
warn about its use without first checking > 0 and have a check of
upper bond limit, so perhaps just having it set to UHID_DATA_MAX or
dynamically allocate a buffer to match the output MTU size of the
control channel would better imo.
--
Luiz Augusto von Dentz
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
