Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ] hog-lib: Check if Report ID is set before prepending it
Date:   Wed, 20 Apr 2022 13:14:37 -0700
Message-Id: <20220420201437.2855806-1-luiz.dentz@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Before prepending the Report ID check if it is non-zero:

BLUETOOTH SPECIFICATION Page 16 of 26
HID Service Specification

Report ID shall be nonzero in a Report Reference characteristic
descriptor where there is more than one instance of the Report
characteristic for any given Report Type.

Fixes: https://github.com/bluez/bluez/issues/334
Fixes: https://github.com/bluez/bluez/issues/320
Fixes: https://www.spinics.net/lists/linux-bluetooth/msg97262.html
---
 profiles/input/hog-lib.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/profiles/input/hog-lib.c b/profiles/input/hog-lib.c
index b611f6b4a..e69ea1ba4 100644
--- a/profiles/input/hog-lib.c
+++ b/profiles/input/hog-lib.c
@@ -348,7 +348,14 @@ static void report_value_cb(const guint8 *pdu, guint16 len, gpointer user_data)
 	ev.type = UHID_INPUT;
 	buf = ev.u.input.data;
 
-	if (report->numbered) {
+	/* BLUETOOTH SPECIFICATION Page 16 of 26
+	 * HID Service Specification
+	 *
+	 * Report ID shall be nonzero in a Report Reference characteristic
+	 * descriptor where there is more than one instance of the Report
+	 * characteristic for any given Report Type.
+	 */
+	if (report->numbered && report->id) {
 		buf[0] = report->id;
 		len = MIN(len, sizeof(ev.u.input.data) - 1);
 		memcpy(buf + 1, pdu, len);
-- 
2.35.1