[PATCH 1/4] android/hidhost: Fix handle_uhid_output

[PATCH 1/4] android/hidhost: Fix handle_uhid_output

[Szymon Janc]

Data from kernel is not in form of hex string. Just copy it instead of
converting from hex string.
---
 android/hidhost.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/hidhost.c b/android/hidhost.c
index d45e1bd..b8d2d8f 100644
--- a/android/hidhost.c
+++ b/android/hidhost.c
@@ -180,13 +180,13 @@ static void handle_uhid_output(struct hid_device *dev,
 	if (!(dev->ctrl_io))
 		return;
 
-	req_size = 1 + (output->size / 2);
+	req_size = 1 + output->size;
 	req = g_try_malloc0(req_size);
 	if (!req)
 		return;
 
 	req[0] = HID_MSG_SET_REPORT | output->rtype;
-	hex2buf(output->data, req + 1, req_size - 1);
+	memcpy(req + 1, output->data, req_size - 1);
 
 	fd = g_io_channel_unix_get_fd(dev->ctrl_io);
 
-- 
1.9.1

[PATCH 2/4] android/hidhost: Cleanup handle_uhid_output

[Szymon Janc]

---
 android/hidhost.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/android/hidhost.c b/android/hidhost.c
index b8d2d8f..ea83733 100644
--- a/android/hidhost.c
+++ b/android/hidhost.c
@@ -173,15 +173,14 @@ static void hex2buf(const uint8_t *hex, uint8_t *buf, int num)
 static void handle_uhid_output(struct hid_device *dev,
 						struct uhid_output_req *output)
 {
-	int fd;
-	uint8_t *req = NULL;
-	uint8_t req_size = 0;
+	int fd, req_size;
+	uint8_t *req;
 
-	if (!(dev->ctrl_io))
+	if (!dev->ctrl_io)
 		return;
 
 	req_size = 1 + output->size;
-	req = g_try_malloc0(req_size);
+	req = malloc0(req_size);
 	if (!req)
 		return;
 
@@ -191,10 +190,10 @@ static void handle_uhid_output(struct hid_device *dev,
 	fd = g_io_channel_unix_get_fd(dev->ctrl_io);
 
 	if (write(fd, req, req_size) < 0)
-		error("error writing set_report: %s (%d)",
-						strerror(errno), errno);
+		error("hidhost: error writing set_report: %s (%d)",
+							strerror(errno), errno);
 
-	g_free(req);
+	free(req);
 }
 
 static gboolean uhid_event_cb(GIOChannel *io, GIOCondition cond,
-- 
1.9.1

[PATCH 3/4] android/hidhost: Don't use sscanf in hex2buf

[Szymon Janc]

Add cheaper version (based on similar code in oFono) that doesn't
require sscanf.
---
 android/hidhost.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/android/hidhost.c b/android/hidhost.c
index ea83733..ab7f7a8 100644
--- a/android/hidhost.c
+++ b/android/hidhost.c
@@ -30,6 +30,7 @@
 #include <errno.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <ctype.h>
 
 #include <glib.h>
 
@@ -162,12 +163,37 @@ static void hid_device_remove(struct hid_device *dev)
 	hid_device_free(dev);
 }
 
-static void hex2buf(const uint8_t *hex, uint8_t *buf, int num)
+static bool hex2buf(const uint8_t *hex, uint8_t *buf, int buf_size)
 {
-	int i;
+	int i, j;
+	char c;
+	uint8_t b;
 
-	for (i = 0; i < num; i++)
-		sscanf((const char *)(hex + (i * 2)), "%02hhX", &buf[i]);
+	for (i = 0, j = 0; i < buf_size; i++, j++) {
+		c = toupper(hex[j]);
+
+		if (c >= '0' && c <= '9')
+			b = c - '0';
+		else if (c >= 'A' && c <= 'F')
+			b = 10 + c - 'A';
+		else
+			return false;
+
+		j++;
+
+		c = toupper(hex[j]);
+
+		if (c >= '0' && c <= '9')
+			b = b * 16 + c - '0';
+		else if (c >= 'A' && c <= 'F')
+			b = b * 16 + 10 + c - 'A';
+		else
+			return false;
+
+		buf[i] = b;
+	}
+
+	return true;
 }
 
 static void handle_uhid_output(struct hid_device *dev,
-- 
1.9.1

[PATCH 4/4] android/hidhost: Check if hex2buf succed

[Szymon Janc]

Fail if received string contains illegal characters.
---
 android/hidhost.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/android/hidhost.c b/android/hidhost.c
index ab7f7a8..65c8de5 100644
--- a/android/hidhost.c
+++ b/android/hidhost.c
@@ -1129,7 +1129,7 @@ static void bt_hid_set_report(const void *buf, uint16_t len)
 	GSList *l;
 	bdaddr_t dst;
 	int fd;
-	uint8_t *req;
+	uint8_t *req = NULL;
 	uint8_t req_size;
 	uint8_t status;
 
@@ -1177,24 +1177,27 @@ static void bt_hid_set_report(const void *buf, uint16_t len)
 	req[0] = HID_MSG_SET_REPORT | cmd->type;
 	/* Report data coming to HAL is in ascii format, HAL sends
 	 * data in hex to daemon, so convert to binary. */
-	hex2buf(cmd->data, req + 1, req_size - 1);
+	if (!hex2buf(cmd->data, req + 1, req_size - 1)) {
+		status = HAL_STATUS_INVALID;
+		goto failed;
+	}
 
 	fd = g_io_channel_unix_get_fd(dev->ctrl_io);
 
 	if (write(fd, req, req_size) < 0) {
 		error("error writing hid_set_report: %s (%d)",
 						strerror(errno), errno);
-		g_free(req);
 		status = HAL_STATUS_FAILED;
 		goto failed;
 	}
 
 	dev->last_hid_msg = HID_MSG_SET_REPORT;
-	g_free(req);
 
 	status = HAL_STATUS_SUCCESS;
 
 failed:
+	g_free(req);
+
 	ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_HIDHOST, HAL_OP_HIDHOST_SET_REPORT,
 									status);
 }
@@ -1206,7 +1209,7 @@ static void bt_hid_send_data(const void *buf, uint16_t len)
 	GSList *l;
 	bdaddr_t dst;
 	int fd;
-	uint8_t *req;
+	uint8_t *req = NULL;
 	uint8_t req_size;
 	uint8_t status;
 
@@ -1244,23 +1247,25 @@ static void bt_hid_send_data(const void *buf, uint16_t len)
 	req[0] = HID_MSG_DATA | HID_DATA_TYPE_OUTPUT;
 	/* Report data coming to HAL is in ascii format, HAL sends
 	 * data in hex to daemon, so convert to binary. */
-	hex2buf(cmd->data, req + 1, req_size - 1);
+	if (!hex2buf(cmd->data, req + 1, req_size - 1)) {
+		status = HAL_STATUS_INVALID;
+		goto failed;
+	}
 
 	fd = g_io_channel_unix_get_fd(dev->intr_io);
 
 	if (write(fd, req, req_size) < 0) {
 		error("error writing data to HID device: %s (%d)",
 						strerror(errno), errno);
-		g_free(req);
 		status = HAL_STATUS_FAILED;
 		goto failed;
 	}
 
-	g_free(req);
-
 	status = HAL_STATUS_SUCCESS;
 
 failed:
+	g_free(req);
+
 	ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_HIDHOST, HAL_OP_HIDHOST_SEND_DATA,
 									status);
 }
-- 
1.9.1

Re: [PATCH 1/4] android/hidhost: Fix handle_uhid_output

[Szymon Janc]

On Friday 18 of April 2014 15:40:03 Szymon Janc wrote:
> Data from kernel is not in form of hex string. Just copy it instead of
> converting from hex string.
> ---
>  android/hidhost.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/android/hidhost.c b/android/hidhost.c
> index d45e1bd..b8d2d8f 100644
> --- a/android/hidhost.c
> +++ b/android/hidhost.c
> @@ -180,13 +180,13 @@ static void handle_uhid_output(struct hid_device *dev,
> if (!(dev->ctrl_io))
>  		return;
> 
> -	req_size = 1 + (output->size / 2);
> +	req_size = 1 + output->size;
>  	req = g_try_malloc0(req_size);
>  	if (!req)
>  		return;
> 
>  	req[0] = HID_MSG_SET_REPORT | output->rtype;
> -	hex2buf(output->data, req + 1, req_size - 1);
> +	memcpy(req + 1, output->data, req_size - 1);
> 
>  	fd = g_io_channel_unix_get_fd(dev->ctrl_io);

Pushed.

-- 
BR
Szymon Janc