Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f547c2fa authored by Nitin Shivpure's avatar Nitin Shivpure Committed by Jakub Pawlowski
Browse files

BLE: Don't access freed buffer in log message 

When GATT fail to write data on L2CAP, buffer is freed by L2CAP.
Accessing the buffer leads to fatal failure while printing the message info.

Test: BLE discover services and BT off test cases

Fixes: 73018520
Change-Id: I661398fd1321f6e68026b3720db4965fd6584d70
Merged-In: I661398fd1321f6e68026b3720db4965fd6584d70
parent 13dca96c

system/stack/gatt/att_protocol.cc

+1 −2
Original line number Diff line number Diff line
@@ -330,8 +330,7 @@ tGATT_STATUS attp_send_msg_to_l2cap(tGATT_TCB* p_tcb, BT_HDR* p_toL2CAP) { 
    l2cap_ret = (uint16_t)L2CA_DataWrite(p_tcb->att_lcid, p_toL2CAP);



  if (l2cap_ret == L2CAP_DW_FAILED) {

    GATT_TRACE_ERROR("ATT   failed to pass msg:0x%0x to L2CAP",

                     *((uint8_t*)(p_toL2CAP + 1) + p_toL2CAP->offset));

    GATT_TRACE_ERROR("ATT failed to pass msg to L2CAP");

    return GATT_INTERNAL_ERROR;

  } else if (l2cap_ret == L2CAP_DW_CONGESTED) {

    GATT_TRACE_DEBUG("ATT congested, message accepted");