Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge branch 'bugfix/pc_ble_prep_buf_memcpy' into 'master'

Browse source 
protocomm_ble : Bugfix for unbound memcpy on prepare write buffer

Closes IDFGH-1350

See merge request idf/esp-idf!5284
This commit is contained in:
Mahavir Jain 2019-06-27 16:48:11 +08:00
commit 5a12be5162
1 changed files with 45 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
components/protocomm/src/transports/protocomm_ble.c
View file

@ -140,29 +140,42 @@ static void transport_simple_ble_read(esp_gatts_cb_event_t event, esp_gatt_if_t
static esp_err_t prepare_write_event_env(esp_gatt_if_t gatts_if, static esp_err_t prepare_write_event_env(esp_gatt_if_t gatts_if,
esp_ble_gatts_cb_param_t *param) esp_ble_gatts_cb_param_t *param)
{ {
ESP_LOGD(TAG, "prepare write, handle = %d, value len = %d", ESP_LOGD(TAG, "prepare write, handle = %d, value len = %d, offset = %d",
param->write.handle, param->write.len); param->write.handle, param->write.len, param->write.offset);
esp_gatt_status_t status = ESP_GATT_OK; esp_gatt_status_t status = ESP_GATT_OK;
if (prepare_write_env.prepare_buf == NULL) {
prepare_write_env.prepare_buf = (uint8_t *) malloc(PREPARE_BUF_MAX_SIZE * sizeof(uint8_t)); /* Ensure that write data is not larger than max attribute length */
if (prepare_write_env.prepare_buf == NULL) {
ESP_LOGE(TAG, "%s , failed tp allocate preparebuf", __func__);
status = ESP_GATT_NO_RESOURCES;
}
/* prepare_write_env.prepare_len = 0; */
} else {
if (param->write.offset > PREPARE_BUF_MAX_SIZE) { if (param->write.offset > PREPARE_BUF_MAX_SIZE) {
status = ESP_GATT_INVALID_OFFSET; status = ESP_GATT_INVALID_OFFSET;
} else if ((param->write.offset + param->write.len) > PREPARE_BUF_MAX_SIZE) { } else if ((param->write.offset + param->write.len) > PREPARE_BUF_MAX_SIZE) {
status = ESP_GATT_INVALID_ATTR_LEN; status = ESP_GATT_INVALID_ATTR_LEN;
} else {
/* If prepare buffer is not allocated, then allocate it */
if (prepare_write_env.prepare_buf == NULL) {
prepare_write_env.prepare_len = 0;
prepare_write_env.prepare_buf = (uint8_t *) malloc(PREPARE_BUF_MAX_SIZE * sizeof(uint8_t));
if (prepare_write_env.prepare_buf == NULL) {
ESP_LOGE(TAG, "%s , failed to allocate prepare buf", __func__);
status = ESP_GATT_NO_RESOURCES;
} }
} }
}
/* If prepare buffer is allocated copy incoming data into it */
if (status == ESP_GATT_OK) {
memcpy(prepare_write_env.prepare_buf + param->write.offset, memcpy(prepare_write_env.prepare_buf + param->write.offset,
param->write.value, param->write.value,
param->write.len); param->write.len);
prepare_write_env.prepare_len += param->write.len; prepare_write_env.prepare_len += param->write.len;
prepare_write_env.handle = param->write.handle; prepare_write_env.handle = param->write.handle;
}
/* Send write response if needed */
if (param->write.need_rsp) { if (param->write.need_rsp) {
esp_err_t response_err;
/* If data was successfully appended to prepare buffer
* only then have it reflected in the response */
if (status == ESP_GATT_OK) {
esp_gatt_rsp_t gatt_rsp = {0}; esp_gatt_rsp_t gatt_rsp = {0};
gatt_rsp.attr_value.len = param->write.len; gatt_rsp.attr_value.len = param->write.len;
gatt_rsp.attr_value.handle = param->write.handle; gatt_rsp.attr_value.handle = param->write.handle;
@ -171,9 +184,12 @@ static esp_err_t prepare_write_event_env(esp_gatt_if_t gatts_if,
if (gatt_rsp.attr_value.len && param->write.value) { if (gatt_rsp.attr_value.len && param->write.value) {
memcpy(gatt_rsp.attr_value.value, param->write.value, param->write.len); memcpy(gatt_rsp.attr_value.value, param->write.value, param->write.len);
} }
esp_err_t response_err = esp_ble_gatts_send_response(gatts_if, param->write.conn_id, response_err = esp_ble_gatts_send_response(gatts_if,
param->write.trans_id, status, param->write.conn_id, param->write.trans_id, status, &gatt_rsp);
&gatt_rsp); } else {
response_err = esp_ble_gatts_send_response(gatts_if,
param->write.conn_id, param->write.trans_id, status, NULL);
}
if (response_err != ESP_OK) { if (response_err != ESP_OK) {
ESP_LOGE(TAG, "Send response error in prep write"); ESP_LOGE(TAG, "Send response error in prep write");
} }
@ -195,7 +211,7 @@ static void transport_simple_ble_write(esp_gatts_cb_event_t event, esp_gatt_if_t
ssize_t outlen = 0; ssize_t outlen = 0;
esp_err_t ret; esp_err_t ret;
ESP_LOGD(TAG, "Inside write with session - %d on attr handle - %d \nLen -%d IS Prep - %d", ESP_LOGD(TAG, "Inside write with session - %d on attr handle = %d \nlen = %d, is_prep = %d",
param->write.conn_id, param->write.handle, param->write.len, param->write.is_prep); param->write.conn_id, param->write.handle, param->write.len, param->write.is_prep);
if (param->write.is_prep) { if (param->write.is_prep) {