michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: GATT: Fix invalid att pointer dereference

Browse source 
This fixes invalid att pointer dereference to get the tx MTU size.

Change-Id: Ifc7911ee58fd4ddff10d1839aff5df9a6e805de8
Signed-off-by: Mariusz Skamra <mariusz.skamra@tieto.com>
This commit is contained in:
Mariusz Skamra 2016-01-14 15:49:50 +01:00 • committed by Anas Nashif
commit 66cb6b335e
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
net/bluetooth/att.c
View file

@ -418,10 +418,11 @@ static uint8_t find_type_cb(const struct bt_gatt_attr *attr, void *user_data)
return BT_GATT_ITER_CONTINUE;
}
static uint8_t att_find_type_rsp(struct bt_conn *conn, uint16_t start_handle,
static uint8_t att_find_type_rsp(struct bt_att *att, uint16_t start_handle,
uint16_t end_handle, const void *value,
uint8_t value_len)
{
struct bt_conn *conn = att->chan.conn;
struct find_type_data data;
memset(&data, 0, sizeof(data));
@ -431,6 +432,7 @@ static uint8_t att_find_type_rsp(struct bt_conn *conn, uint16_t start_handle,
return BT_ATT_ERR_UNLIKELY;
}
data.att = att;
data.value = value;
data.value_len = value_len;
@ -483,7 +485,7 @@ static uint8_t att_find_type_req(struct bt_att *att, struct net_buf *buf)
return 0;
}
return att_find_type_rsp(conn, start_handle, end_handle, value,
return att_find_type_rsp(att, start_handle, end_handle, value,
buf->len);
}