Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

compoent/bt: Modify bta_gattc_utils.c The value pointer copy is overwritten when a write event occurs.

Browse source
This commit is contained in:
Yulong 2017-11-09 01:44:16 -05:00
parent 8ca40818eb
commit 1ceef12238
1 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
components/bt/bluedroid/bta/gatt/bta_gattc_utils.c
View file

@ -461,17 +461,23 @@ BOOLEAN bta_gattc_enqueue(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
return FALSE;
}
if (p_data->hdr.event == BTA_GATTC_API_WRITE_EVT) {
if (p_data->hdr.event == BTA_GATTC_API_WRITE_EVT) {
len = p_data->api_write.len;
cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA) + len);
cmd_data->api_write.p_value = (UINT8 *)(cmd_data + 1);
memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
memcpy(cmd_data->api_write.p_value, p_data->api_write.p_value, len);
} else {
cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA));
memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA));
memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
if ((cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA) + len)) != NULL) {
memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA) + len);
memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
cmd_data->api_write.p_value = (UINT8 *)(cmd_data + 1);
memcpy(cmd_data->api_write.p_value, p_data->api_write.p_value, len);
} else {
APPL_TRACE_ERROR("%s(), alloc fail, no memery.", __func__);
}
} else {
if ((cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA))) != NULL) {
memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA));
memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
} else {
APPL_TRACE_ERROR("%s(), alloc fail, no memery.", __func__);
}
}
//store the command to the command list.