michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: GATT: Fix discover callback invalid pointer

Browse source 
Fix issues that surfaced when trying out GCC 9.2, official release name
gcc-arm-none-eabi-9-2019-q4-major, both related to invalid pointers in
GATT when declaring UUIDs in if-scope.

1. Fix the discovery callback giving an invalid pointer in the discovery
callback in two instances.
2. Fix gatt_find_type sending invalid data during discovery procedure.

Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
This commit is contained in:
Joakim Andersson 2019-12-04 15:29:20 +01:00 • committed by Johan Hedberg
commit b5f70ef1c0
1 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
subsys/bluetooth/host/gatt.c
View file

@ -2312,6 +2312,7 @@ static void gatt_find_type_rsp(struct bt_conn *conn, u8_t err,
/* Parse attributes found */
for (i = 0U; length >= sizeof(rsp->list[i]);
i++, length -= sizeof(rsp->list[i])) {
struct bt_uuid_16 uuid_svc;
struct bt_gatt_attr attr = {};
struct bt_gatt_service_val value;
@ -2321,15 +2322,17 @@ static void gatt_find_type_rsp(struct bt_conn *conn, u8_t err,
BT_DBG("start_handle 0x%04x end_handle 0x%04x", start_handle,
end_handle);
uuid_svc.uuid.type = BT_UUID_TYPE_16;
if (params->type == BT_GATT_DISCOVER_PRIMARY) {
attr.uuid = BT_UUID_GATT_PRIMARY;
uuid_svc.val = BT_UUID_16(BT_UUID_GATT_PRIMARY)->val;
} else {
attr.uuid = BT_UUID_GATT_SECONDARY;
uuid_svc.val = BT_UUID_16(BT_UUID_GATT_SECONDARY)->val;
}
value.end_handle = end_handle;
value.uuid = params->uuid;
attr.uuid = &uuid_svc.uuid;
attr.handle = start_handle;
attr.user_data = &value;
@ -2353,9 +2356,9 @@ done:
static int gatt_find_type(struct bt_conn *conn,
struct bt_gatt_discover_params *params)
{
u16_t uuid_val;
struct net_buf *buf;
struct bt_att_find_type_req *req;
struct bt_uuid *uuid;
buf = bt_att_create_pdu(conn, BT_ATT_OP_FIND_TYPE_REQ, sizeof(*req));
if (!buf) {
@ -2367,12 +2370,12 @@ static int gatt_find_type(struct bt_conn *conn,
req->end_handle = sys_cpu_to_le16(params->end_handle);
if (params->type == BT_GATT_DISCOVER_PRIMARY) {
uuid = BT_UUID_GATT_PRIMARY;
uuid_val = BT_UUID_16(BT_UUID_GATT_PRIMARY)->val;
} else {
uuid = BT_UUID_GATT_SECONDARY;
uuid_val = BT_UUID_16(BT_UUID_GATT_SECONDARY)->val;
}
req->type = sys_cpu_to_le16(BT_UUID_16(uuid)->val);
req->type = sys_cpu_to_le16(uuid_val);
BT_DBG("uuid %s start_handle 0x%04x end_handle 0x%04x",
bt_uuid_str(params->uuid), params->start_handle,
@ -2716,6 +2719,7 @@ static u16_t parse_service(struct bt_conn *conn, const void *pdu,
/* Parse services found */
for (length--, pdu = rsp->data; length >= rsp->len;
length -= rsp->len, pdu = (const u8_t *)pdu + rsp->len) {
struct bt_uuid_16 uuid_svc;
struct bt_gatt_attr attr = {};
struct bt_gatt_service_val value;
const struct bt_att_group_data *data = pdu;
@ -2743,15 +2747,17 @@ static u16_t parse_service(struct bt_conn *conn, const void *pdu,
BT_DBG("start_handle 0x%04x end_handle 0x%04x uuid %s",
start_handle, end_handle, bt_uuid_str(&u.uuid));
uuid_svc.uuid.type = BT_UUID_TYPE_16;
if (params->type == BT_GATT_DISCOVER_PRIMARY) {
attr.uuid = BT_UUID_GATT_PRIMARY;
uuid_svc.val = BT_UUID_16(BT_UUID_GATT_PRIMARY)->val;
} else {
attr.uuid = BT_UUID_GATT_SECONDARY;
uuid_svc.val = BT_UUID_16(BT_UUID_GATT_SECONDARY)->val;
}
value.end_handle = end_handle;
value.uuid = &u.uuid;
attr.uuid = &uuid_svc.uuid;
attr.handle = start_handle;
attr.user_data = &value;