Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

compoent/bt: Modify bta_gattc_utils.c The value pointer copy is overwritten when a write event occurs.

Browse source
This commit is contained in:
Yulong 2017-11-09 01:44:16 -05:00 committed by yulong
parent e6b2c19eea
commit ee43527108
1 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
components/bt/bluedroid/bta/gatt/bta_gattc_utils.c
View file

@ -463,15 +463,21 @@ BOOLEAN bta_gattc_enqueue(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
if (p_data->hdr.event == BTA_GATTC_API_WRITE_EVT) {
len = p_data->api_write.len;
cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA) + len);
cmd_data->api_write.p_value = (UINT8 *)(cmd_data + 1);
if ((cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA) + len)) != NULL) {
memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA) + len);
memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
cmd_data->api_write.p_value = (UINT8 *)(cmd_data + 1);
memcpy(cmd_data->api_write.p_value, p_data->api_write.p_value, len);
} else {
cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA));
APPL_TRACE_ERROR("%s(), alloc fail, no memery.", __func__);
}
} else {
if ((cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA))) != NULL) {
memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA));
memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
} else {
APPL_TRACE_ERROR("%s(), alloc fail, no memery.", __func__);
}
}
//store the command to the command list.