Skip to content

Commit 4b1d569

Browse files
carterdfpistm
authored andcommitted
Fix for issue arduino-libraries#245 - ATT_OP_FIND_INFO_RESP incorrect processing during ATTClass::discoverDescriptors causes crashing
I've highlighted this issue on 9th July ... this is an issue of causing __CRASHES__ if using ArduinoBLE to connect as central and the response to ATT_OP_FIND_INFO_RESP includes 128-bit UUIDs.
1 parent 38a264c commit 4b1d569

File tree

1 file changed

+13
-2
lines changed

1 file changed

+13
-2
lines changed

src/utility/ATT.cpp

+13-2
Original file line numberDiff line numberDiff line change
@@ -1728,8 +1728,19 @@ bool ATTClass::discoverDescriptors(uint16_t connectionHandle, BLERemoteDevice* d
17281728
}
17291729

17301730
if (responseBuffer[0] == ATT_OP_FIND_INFO_RESP) {
1731-
uint16_t lengthPerDescriptor = responseBuffer[1] * 4;
1732-
uint8_t uuidLen = 2;
1731+
//
1732+
// Format parameter (responseBuffer[1]) either 0x01 - 16-bit Bluetooth UUID(s), or 0x02 - 128 bit UUID(s)
1733+
//
1734+
// Therefore for:
1735+
// 0x01 - uuidLen = 2 (octets)
1736+
// lengthPerDescriptor = 4 (Handle 2 octets + UUID 2 octets)
1737+
// 0x02 - uuidLen = 16 (octets)
1738+
// lengthPerDescriptor = 18 (Handle 2 octets + UUID 16 octets)
1739+
//
1740+
// See section 3.4.3.2 ATT_FIND_INFORMATION_RSP of Bluetooth Core Specification 5.3.
1741+
//
1742+
uint16_t lengthPerDescriptor = responseBuffer[1] * 14 - 10;
1743+
uint8_t uuidLen = lengthPerDescriptor - 2;
17331744

17341745
for (int i = 2; i < respLength; i += lengthPerDescriptor) {
17351746
struct __attribute__ ((packed)) RawDescriptor {

0 commit comments

Comments
 (0)