Skip to content

Commit e76c7d9

Browse files
carterdfpistm
authored andcommitted
Fix for issue arduino-libraries#245 - ATT_OP_FIND_INFO_RESP incorrect processing during ATTClass::discoverDescriptors causes crashing
I've highlighted this issue on 9th July ... this is an issue of causing __CRASHES__ if using ArduinoBLE to connect as central and the response to ATT_OP_FIND_INFO_RESP includes 128-bit UUIDs.
1 parent a35e40b commit e76c7d9

File tree

1 file changed

+13
-2
lines changed

1 file changed

+13
-2
lines changed

src/utility/ATT.cpp

+13-2
Original file line numberDiff line numberDiff line change
@@ -1729,8 +1729,19 @@ bool ATTClass::discoverDescriptors(uint16_t connectionHandle, BLERemoteDevice* d
17291729
}
17301730

17311731
if (responseBuffer[0] == ATT_OP_FIND_INFO_RESP) {
1732-
uint16_t lengthPerDescriptor = responseBuffer[1] * 4;
1733-
uint8_t uuidLen = 2;
1732+
//
1733+
// Format parameter (responseBuffer[1]) either 0x01 - 16-bit Bluetooth UUID(s), or 0x02 - 128 bit UUID(s)
1734+
//
1735+
// Therefore for:
1736+
// 0x01 - uuidLen = 2 (octets)
1737+
// lengthPerDescriptor = 4 (Handle 2 octets + UUID 2 octets)
1738+
// 0x02 - uuidLen = 16 (octets)
1739+
// lengthPerDescriptor = 18 (Handle 2 octets + UUID 16 octets)
1740+
//
1741+
// See section 3.4.3.2 ATT_FIND_INFORMATION_RSP of Bluetooth Core Specification 5.3.
1742+
//
1743+
uint16_t lengthPerDescriptor = responseBuffer[1] * 14 - 10;
1744+
uint8_t uuidLen = lengthPerDescriptor - 2;
17341745

17351746
for (int i = 2; i < respLength; i += lengthPerDescriptor) {
17361747
struct __attribute__ ((packed)) RawDescriptor {

0 commit comments

Comments
 (0)