Skip to content

Commit c912926

Browse files
sgbihuSidLeung
authored andcommitted
Jira 868, BLE Peripheral stack crash with long write, git456
Root cause: - Upon processing the write event, The received user data was casted incorrectly using the base class. Resulted in using an incorrect offset that caused memcpy to use incorrect address and length. Code Mods: 1. BLECallbacks.cpp: Adjust the typecast order, from base class to child class in profile_longwrite_process() and profile_longflush_process().
1 parent 3612e08 commit c912926

File tree

1 file changed

+14
-2
lines changed

1 file changed

+14
-2
lines changed

libraries/CurieBLE/src/internal/BLECallbacks.cpp

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,13 @@ ssize_t profile_longwrite_process(struct bt_conn *conn,
7777
const void *buf, uint16_t len,
7878
uint16_t offset)
7979
{
80-
BLECharacteristicImp *blecharacteritic = (BLECharacteristicImp*)attr->user_data;
80+
BLEAttribute *bleattr = (BLEAttribute *)attr->user_data;
81+
BLEAttributeType type = bleattr->type();
82+
if (BLETypeCharacteristic != type)
83+
{
84+
return 0;
85+
}
86+
BLECharacteristicImp *blecharacteritic = (BLECharacteristicImp*)bleattr;
8187

8288
blecharacteritic->setBuffer((const uint8_t *) buf, len, offset);
8389

@@ -88,7 +94,13 @@ int profile_longflush_process(struct bt_conn *conn,
8894
const struct bt_gatt_attr *attr,
8995
uint8_t flags)
9096
{
91-
BLECharacteristicImp *blecharacteritic = (BLECharacteristicImp*)attr->user_data;
97+
BLEAttribute *bleattr = (BLEAttribute *)attr->user_data;
98+
BLEAttributeType type = bleattr->type();
99+
if (BLETypeCharacteristic != type)
100+
{
101+
return 0;
102+
}
103+
BLECharacteristicImp *blecharacteritic = (BLECharacteristicImp*)bleattr;
92104

93105
switch (flags)
94106
{

0 commit comments

Comments
 (0)