Fix a OOB bug in bta_hh_co_get_rpt_rsp am: f173fcb4

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21090924



Change-Id: Idfe58b567a3484ddcf8be45e1515b6349ed290f3
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

system/btif/co/bta_hh_co.cc

@@ -661,13 +661,14 @@ void bta_hh_co_get_rpt_rsp(uint8_t dev_handle, uint8_t status, uint8_t* p_rpt,
     ev.u.feature_answer.err = status;
     ev.u.feature_answer.size = len;
     osi_free(get_rpt_id);
-    if (len > 0) {
-      if (len > UHID_DATA_MAX) {
+
+    if (len >= GET_RPT_RSP_OFFSET) {
+      if (len - GET_RPT_RSP_OFFSET > UHID_DATA_MAX) {
         APPL_TRACE_WARNING("%s: Report size greater than allowed size",
                            __func__);
         return;
       }
-      memcpy(ev.u.feature_answer.data, p_rpt + GET_RPT_RSP_OFFSET, len);
+      memcpy(ev.u.feature_answer.data, p_rpt + GET_RPT_RSP_OFFSET, len - GET_RPT_RSP_OFFSET);
       uhid_write(p_dev->fd, &ev);
     }
   }