Fix broken HIDPowerDevice_::sendDate method

The method currently uses a local "bval" variable as argument when calling HID().SendReport(...). This is problematic, since the SendReport method doesn't use "bval" immediately. It instead captures a pointer to "bval" which is accessed when the report is sent at a later point. This leads to a use-after-free situation when the pointer captured by SendReport may no longer point to "bval".

Propose to fix the issue by introducing a new "iManufacturerDate" member in the HIDPowerDevice class to act as persistent storage for the date value.

Author: forderud

src/HIDPowerDevice.cpp

@@ -250,8 +250,8 @@ void HIDPowerDevice_::end(void) {
 }
 
 int HIDPowerDevice_::sendDate(uint16_t id, uint16_t year, uint8_t month, uint8_t day) {
-    uint16_t bval = (year - 1980)*512 + month * 32 + day;
-    return HID().SendReport(id, &bval, sizeof (bval));
+    iManufacturerDate = (year - 1980)*512 + month * 32 + day; // from 4.2.6 Battery Settings in "Universal Serial Bus Usage Tables for HID Power Devices"
+    return HID().SendReport(id, &iManufacturerDate, sizeof(iManufacturerDate));
 }
 
 int HIDPowerDevice_::sendReport(uint16_t id, const void* bval, int len) {

src/HIDPowerDevice.h

@@ -128,6 +128,8 @@ class HIDPowerDevice_  {
 
   int setStringFeature(uint8_t id, const uint8_t* index, const char* data);
 
+private:
+  uint16_t iManufacturerDate = 0;
 };
 
 extern HIDPowerDevice_ PowerDevice;