Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d529506 authored by Nitin Shivpure's avatar Nitin Shivpure Committed by Stanley Tng
Browse files

BLE: Don't access freed buffer in log message 

When GATT fail to write data on L2CAP, buffer is freed by L2CAP.
Accessing the buffer leads to fatal failure while printing the message info.

Test: BLE discover services and BT off test cases

Fixes: 73018520
Change-Id: I661398fd1321f6e68026b3720db4965fd6584d70
parent 0ccd553d

system/stack/gatt/att_protocol.cc

+1 −3
Original line number Original line Diff line number Diff line
@@ -331,9 +331,7 @@ tGATT_STATUS attp_send_msg_to_l2cap(tGATT_TCB& tcb, BT_HDR* p_toL2CAP) { 
    l2cap_ret = (uint16_t)L2CA_DataWrite(tcb.att_lcid, p_toL2CAP);

    l2cap_ret = (uint16_t)L2CA_DataWrite(tcb.att_lcid, p_toL2CAP);





  if (l2cap_ret == L2CAP_DW_FAILED) {

  if (l2cap_ret == L2CAP_DW_FAILED) {

    LOG(ERROR) << StringPrintf(

    LOG(ERROR) << __func__ << ": failed to write data to L2CAP";

        "ATT   failed to pass msg:0x%0x to L2CAP",

        *((uint8_t*)(p_toL2CAP + 1) + p_toL2CAP->offset));

    return GATT_INTERNAL_ERROR;

    return GATT_INTERNAL_ERROR;

  } else if (l2cap_ret == L2CAP_DW_CONGESTED) {

  } else if (l2cap_ret == L2CAP_DW_CONGESTED) {

    VLOG(1) << StringPrintf("ATT congested, message accepted");

    VLOG(1) << StringPrintf("ATT congested, message accepted");