Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53a89d92 authored by Nitin Shivpure's avatar Nitin Shivpure Committed by Jakub Pawlowski
Browse files

BLE: Don't access freed buffer in log message 

When GATT fail to write data on L2CAP, buffer is freed by L2CAP.
Accessing the buffer leads to fatal failure while printing the message info.

Test: BLE discover services and BT off test cases

Fixes: 73018520
Change-Id: I661398fd1321f6e68026b3720db4965fd6584d70
Merged-In: I661398fd1321f6e68026b3720db4965fd6584d70
parent fb614b99

system/stack/gatt/att_protocol.c

+1 −2
Original line number Original line Diff line number Diff line
@@ -364,8 +364,7 @@ tGATT_STATUS attp_send_msg_to_l2cap(tGATT_TCB *p_tcb, BT_HDR *p_toL2CAP) 




    if (l2cap_ret == L2CAP_DW_FAILED)

    if (l2cap_ret == L2CAP_DW_FAILED)

    {

    {

        GATT_TRACE_ERROR("ATT   failed to pass msg:0x%0x to L2CAP",

        GATT_TRACE_ERROR("ATT   failed to pass msg to L2CAP");

            *((UINT8 *)(p_toL2CAP + 1) + p_toL2CAP->offset));

        return GATT_INTERNAL_ERROR;

        return GATT_INTERNAL_ERROR;

    }

    }

    else if (l2cap_ret == L2CAP_DW_CONGESTED)

    else if (l2cap_ret == L2CAP_DW_CONGESTED)