diff options
| author | Sheldon Demario <sheldon.demario@openbossa.org> | 2010-11-29 07:44:22 -0500 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@nokia.com> | 2010-11-29 19:24:07 +0200 |
| commit | 90dec87b5c086d5eff4e34b93055ddaa34726830 (patch) | |
| tree | ce55663423fd03fd658a6517085fa6e20aa1772b /attrib/att.c | |
| parent | f68cb33e96560801eb1570d35ffc2429054b8783 (diff) | |
| download | bluez-90dec87b5c086d5eff4e34b93055ddaa34726830.tar.gz | |
Attrib server should truncate attribute value to pdu length
When the size of attribute value is greater than pdu size, it should be
truncated to the pdu length - 2
Diffstat (limited to 'attrib/att.c')
| -rw-r--r-- | attrib/att.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/attrib/att.c b/attrib/att.c index 8655e5e65..445b192be 100644 --- a/attrib/att.c +++ b/attrib/att.c @@ -379,7 +379,7 @@ uint16_t dec_read_by_type_req(const uint8_t *pdu, int len, uint16_t *start, uint16_t enc_read_by_type_resp(struct att_data_list *list, uint8_t *pdu, int len) { uint8_t *ptr; - int i, w; + int i, w, l; if (list == NULL) return 0; @@ -387,17 +387,16 @@ uint16_t enc_read_by_type_resp(struct att_data_list *list, uint8_t *pdu, int len if (pdu == NULL) return 0; - if (len < list->len + 2) - return 0; + l = MIN(len - 2, list->len); pdu[0] = ATT_OP_READ_BY_TYPE_RESP; - pdu[1] = list->len; + pdu[1] = l; ptr = &pdu[2]; - for (i = 0, w = 2; i < list->num && w + list->len <= len; i++) { - memcpy(ptr, list->data[i], list->len); - ptr += list->len; - w += list->len; + for (i = 0, w = 2; i < list->num && w + l <= len; i++) { + memcpy(ptr, list->data[i], l); + ptr += l; + w += l; } return w; |