michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: RFCOMM: Fix length errors when payload exceeds 127

Browse source 
hdr->length is the length of the payload, it should be
buf->len - sizeof(*hdr) - 1 or buf->len - (sizeof(*hdr) + 1)

Signed-off-by: ZhongYao Luo <LuoZhongYao@gmail.com>
This commit is contained in:
ZhongYao Luo 2019-12-26 14:26:26 +08:00 • committed by Johan Hedberg
commit a94e81ba3e
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
subsys/bluetooth/host/rfcomm.c
View file

@ -1431,7 +1431,7 @@ int bt_rfcomm_dlc_send(struct bt_rfcomm_dlc *dlc, struct net_buf *buf)
hdr = net_buf_push(buf, sizeof(*hdr) + 1);
len = (u16_t *)&hdr->length;
*len = BT_RFCOMM_SET_LEN_16(sys_cpu_to_le16(buf->len -
sizeof(*hdr) + 1));
sizeof(*hdr) - 1));
} else {
hdr = net_buf_push(buf, sizeof(*hdr));
hdr->length = BT_RFCOMM_SET_LEN_8(buf->len - sizeof(*hdr));