diff options
| author | Lukasz Rymanowski <lukasz.rymanowski@tieto.com> | 2015-02-26 10:39:38 +0100 |
|---|---|---|
| committer | Szymon Janc <szymon.janc@tieto.com> | 2015-02-27 16:33:56 +0100 |
| commit | 92218dc7bbc9bf7912c2960566f28474361717e3 (patch) | |
| tree | 90f53f8228d251645973e3800907aa1a1f763726 /attrib | |
| parent | ba84f73cdde18257c18fc79848e7f43571ff25f4 (diff) | |
| download | bluez-92218dc7bbc9bf7912c2960566f28474361717e3.tar.gz | |
attrib/gatt: Improve robustness when searching for included services
Without this patch it is possible to enter infinite loop when
searching included services on remote device. This patch fixes that.
Issue happens when remote device replies with ending handle which is
lower than start handle we use for search
Diffstat (limited to 'attrib')
| -rw-r--r-- | attrib/gatt.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/attrib/gatt.c b/attrib/gatt.c index bc2f92a39..ea5c1cf83 100644 --- a/attrib/gatt.c +++ b/attrib/gatt.c @@ -55,6 +55,7 @@ struct included_discovery { unsigned int id; int refs; int err; + uint16_t start_handle; uint16_t end_handle; GSList *includes; gatt_cb_t cb; @@ -549,8 +550,19 @@ static void find_included_cb(uint8_t status, const uint8_t *pdu, uint16_t len, att_data_list_free(list); + /* + * If last handle is lower from previous start handle then it is smth + * wrong. Let's stop search, otherwise we might enter infinite loop. + */ + if (last_handle < isd->start_handle) { + isd->err = ATT_ECODE_UNLIKELY; + goto done; + } + + isd->start_handle = last_handle + 1; + if (last_handle < isd->end_handle) - find_included(isd, last_handle + 1); + find_included(isd, isd->start_handle); done: if (isd->err == 0) @@ -564,6 +576,7 @@ unsigned int gatt_find_included(GAttrib *attrib, uint16_t start, uint16_t end, isd = g_new0(struct included_discovery, 1); isd->attrib = g_attrib_ref(attrib); + isd->start_handle = start; isd->end_handle = end; isd->cb = func; isd->user_data = user_data; |