Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75ebd409 authored by Nitin Shivpure's avatar Nitin Shivpure Committed by Jakub Pawlowski
Browse files

BLE: Don't access freed buffer in log message 

When GATT fail to write data on L2CAP, buffer is freed by L2CAP.
Accessing the buffer leads to fatal failure while printing the message info.

Test: BLE discover services and BT off test cases

Fixes: 73018520
Change-Id: I661398fd1321f6e68026b3720db4965fd6584d70
Merged-In: I661398fd1321f6e68026b3720db4965fd6584d70
parent 3b6a7e27

system/stack/gatt/att_protocol.cc

+1 −3
Original line number Diff line number Diff line
@@ -330,9 +330,7 @@ tGATT_STATUS attp_send_msg_to_l2cap(tGATT_TCB& tcb, BT_HDR* p_toL2CAP) { 
    l2cap_ret = (uint16_t)L2CA_DataWrite(tcb.att_lcid, p_toL2CAP);



  if (l2cap_ret == L2CAP_DW_FAILED) {

    LOG(ERROR) << StringPrintf(

        "ATT   failed to pass msg:0x%0x to L2CAP",

        *((uint8_t*)(p_toL2CAP + 1) + p_toL2CAP->offset));

    LOG(ERROR) << __func__ << ": failed to write data to L2CAP";

    return GATT_INTERNAL_ERROR;

  } else if (l2cap_ret == L2CAP_DW_CONGESTED) {

    VLOG(1) << StringPrintf("ATT congested, message accepted");