alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'bugfix/fix_gattc_disc_char_by_uuid_panic' into 'master'

Browse Source 
Bluedroid: correct the length of att read by type pdu

Closes BT-2874

See merge request espressif/esp-idf!20686
This commit is contained in:
Wang Meng Yang 2022-10-21 17:24:03 +08:00
commit 2cbc83a4c7
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
components/bt/host/bluedroid/stack/gatt/att_protocol.c
View File

@ -134,8 +134,10 @@ BT_HDR *attp_build_browse_cmd(UINT8 op_code, UINT16 s_hdl, UINT16 e_hdl, tBT_UUI
{ {
BT_HDR *p_buf = NULL; BT_HDR *p_buf = NULL;
UINT8 *p; UINT8 *p;
/* length of ATT_READ_BY_TYPE_REQ PDU: opcode(1) + start_handle (2) + end_handle (2) + uuid (2 or 16) */
const UINT8 payload_size = 1 + 2 + 2 + ((uuid.len == LEN_UUID_16) ? LEN_UUID_16 : LEN_UUID_128);
if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + 8 + L2CAP_MIN_OFFSET)) != NULL) { if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET)) != NULL) {
p = (UINT8 *)(p_buf + 1) + L2CAP_MIN_OFFSET; p = (UINT8 *)(p_buf + 1) + L2CAP_MIN_OFFSET;
/* Describe the built message location and size */ /* Describe the built message location and size */
p_buf->offset = L2CAP_MIN_OFFSET; p_buf->offset = L2CAP_MIN_OFFSET;