Skip to content

Commit a5bd4f0

Browse files
carterdfpistm
authored andcommitted
Fix for issue arduino-libraries#245 - ATT_OP_FIND_INFO_RESP incorrect processing during ATTClass::discoverDescriptors causes crashing
I've highlighted this issue on 9th July ... this is an issue of causing __CRASHES__ if using ArduinoBLE to connect as central and the response to ATT_OP_FIND_INFO_RESP includes 128-bit UUIDs.
1 parent 1b9d1e8 commit a5bd4f0

File tree

1 file changed

+13
-2
lines changed

1 file changed

+13
-2
lines changed

src/utility/ATT.cpp

+13-2
Original file line numberDiff line numberDiff line change
@@ -1745,8 +1745,19 @@ bool ATTClass::discoverDescriptors(uint16_t connectionHandle, BLERemoteDevice* d
17451745
}
17461746

17471747
if (responseBuffer[0] == ATT_OP_FIND_INFO_RESP) {
1748-
uint16_t lengthPerDescriptor = responseBuffer[1] * 4;
1749-
uint8_t uuidLen = 2;
1748+
//
1749+
// Format parameter (responseBuffer[1]) either 0x01 - 16-bit Bluetooth UUID(s), or 0x02 - 128 bit UUID(s)
1750+
//
1751+
// Therefore for:
1752+
// 0x01 - uuidLen = 2 (octets)
1753+
// lengthPerDescriptor = 4 (Handle 2 octets + UUID 2 octets)
1754+
// 0x02 - uuidLen = 16 (octets)
1755+
// lengthPerDescriptor = 18 (Handle 2 octets + UUID 16 octets)
1756+
//
1757+
// See section 3.4.3.2 ATT_FIND_INFORMATION_RSP of Bluetooth Core Specification 5.3.
1758+
//
1759+
uint16_t lengthPerDescriptor = responseBuffer[1] * 14 - 10;
1760+
uint8_t uuidLen = lengthPerDescriptor - 2;
17501761

17511762
for (int i = 2; i < respLength; i += lengthPerDescriptor) {
17521763
struct __attribute__ ((packed)) RawDescriptor {

0 commit comments

Comments
 (0)