Commit 598ef74d authored by Louis Caron's avatar Louis Caron Committed by Anas Nashif
Browse files

Bluetooth: fix write cmd handling 



The data pointer and length was not updated before invoking the
write_rsp function therefore providing pointer to the handle.

Change-Id: I5c27ab7a793979dffb8f1f2c68def027c45f2376
Signed-off-by: default avatarLouis Caron <louis.caron@intel.com>
parent d568a04f

subsys/bluetooth/host/att.c

+2 −14
Original line number Diff line number Diff line
@@ -1185,13 +1185,9 @@ static uint8_t att_write_rsp(struct bt_conn *conn, uint8_t op, uint8_t rsp, 
static uint8_t att_write_req(struct bt_att *att, struct net_buf *buf)

{

	struct bt_conn *conn = att->chan.chan.conn;

	struct bt_att_write_req *req;

	uint16_t handle;



	req = (void *)buf->data;



	handle = sys_le16_to_cpu(req->handle);

	net_buf_pull(buf, sizeof(*req));

	handle = net_buf_pull_le16(buf);



	BT_DBG("handle 0x%04x", handle);
@@ -1384,17 +1380,9 @@ static uint8_t att_exec_write_req(struct bt_att *att, struct net_buf *buf) 
static uint8_t att_write_cmd(struct bt_att *att, struct net_buf *buf)

{

	struct bt_conn *conn = att->chan.chan.conn;

	struct bt_att_write_cmd *req;

	uint16_t handle;



	if (buf->len < sizeof(*req)) {

		/* Commands don't have any response */

		return 0;

	}



	req = (void *)buf->data;



	handle = sys_le16_to_cpu(req->handle);

	handle = net_buf_pull_le16(buf);



	BT_DBG("handle 0x%04x", handle);

CRA Git | Maintained and supported by SUSTech CRA and CCSE