Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40422295 authored by Subramanian Srinivasan's avatar Subramanian Srinivasan Committed by Andre Eisenbach
Browse files

Validates the PDU length of GATT Prepare Write attribute requests 

Validates whether the PDU length of GATT Prepare Write
requests satisfy the minimum length requirements of
GATT write attribute request format.

Change-Id: Id18d32b050389ff8c71341bb738dd77225029acd
parent b0fd65ad

system/stack/gatt/gatt_sr.c

+5 −0
Original line number Diff line number Diff line
@@ -1049,6 +1049,11 @@ void gatts_process_write_req (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 handle, 
    switch (op_code)

    {

        case GATT_REQ_PREPARE_WRITE:

            if (len < 2) {

                GATT_TRACE_ERROR("%s: Prepare write request was invalid - missing offset, sending error response", __func__);

                gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, handle, FALSE);

                return;

            }

            sr_data.write_req.is_prep = TRUE;

            STREAM_TO_UINT16(sr_data.write_req.offset, p);

            len -= 2;