Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/fix_bluedroid_read_by_type_fail' into 'master'

Browse Source 
fix(ble/bluedroid): cap Read By Type response length at ATT maximum

Closes BLERP-2895, BLERP-2896, and BLERP-2897

See merge request espressif/esp-idf!49656
This commit is contained in:
Island
2026-06-26 16:51:19 +08:00
parent ba17bb5c6f 97905afccc
commit b45f379fd1
3 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/gatt/gatt_cl.c
+5 -1
View File
@@ -891,7 +891,11 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
/* value_len is the length of current record's value; use it to avoid overread when multiple records present */
p_clcb->counter = value_len;
p_clcb->s_handle = handle;
if ( p_clcb->counter == (p_clcb->p_tcb->payload_size - 4)) {
UINT16 max_rbtype_val_len = (p_clcb->p_tcb->payload_size - 4);
if (max_rbtype_val_len > GATT_MAX_READ_BY_TYPE_VALUE_LEN) {
max_rbtype_val_len = GATT_MAX_READ_BY_TYPE_VALUE_LEN;
}
if (p_clcb->counter == max_rbtype_val_len) {
p_clcb->op_subtype = GATT_READ_BY_HANDLE;
if (!p_clcb->p_attr_buf) {
p_clcb->p_attr_buf = (UINT8 *)osi_malloc(GATT_MAX_ATTR_LEN);
components/bt/host/bluedroid/stack/gatt/gatt_db.c
+7 -1
View File
@@ -370,7 +370,13 @@ tGATT_STATUS gatts_db_read_attr_value_by_type (tGATT_TCB *p_tcb,
UINT16_TO_STREAM (p, p_attr->handle);
status = read_attr_value ((void *)p_attr, 0, &p, FALSE, (UINT16)(*p_len - 2), &len, sec_flag, key_size);
{
UINT16 max_val_len = (UINT16)(*p_len - 2);
if (max_val_len > GATT_MAX_READ_BY_TYPE_VALUE_LEN) {
max_val_len = GATT_MAX_READ_BY_TYPE_VALUE_LEN;
}
status = read_attr_value ((void *)p_attr, 0, &p, FALSE, max_val_len, &len, sec_flag, key_size);
}
if (status == GATT_PENDING) {
components/bt/host/bluedroid/stack/gatt/include/gatt_int.h
+4
View File
@@ -76,6 +76,10 @@ typedef UINT8 tGATT_SEC_ACTION;
#define GATT_HDR_SIZE 3 /* 1B opcode + 2B handle */
/* ATT Read By Type Response: Length field is 1 octet (max 255). */
#define GATT_MAX_READ_BY_TYPE_PAIR_LEN 255
#define GATT_MAX_READ_BY_TYPE_VALUE_LEN (GATT_MAX_READ_BY_TYPE_PAIR_LEN - 2)
/**
* Wait for ATT cmd response timeout value (40 seconds).
* The max connection supervision timeout is 32 seconds,