Bluetooth: GATT: Check len of response before parsing response PDU
In function `parse_read_by_uuid()`, the response length is not checked
before parsing the response PDU. There is a potential issue that the
`len` will be underflowed if the `len` is less than the size of
`struct bt_att_data`.
Check the length before parsing the response PDU. If the length is less
then the size of `struct bt_att_data`, notify the upper layer with the
error `BT_ATT_ERR_INVALID_PDU` and stop the parsing.
Signed-off-by:
Lyle Zhu <lyle.zhu@nxp.com>
Loading
Please sign in to comment