Skip to content

Conversation

@Vudentz
Copy link
Contributor

@Vudentz Vudentz commented Jun 11, 2019

Although unlikely it is possible that a remote may attempt to send just
1 byte as the write request allows to do that:

BLUETOOTH CORE SPECIFICATION Version 5.1 | Vol 3, Part F
page 2320:

'If the attribute value has a fixed length and the Attribute Value
parameter length is less than or equal to the length of the attribute
value, the octets of the attribute value parameter length shall be
written; all other octets in this attribute value shall be
unchanged.'

Fixes #16734

Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com

@Vudentz Vudentz added bug The issue is a bug, or the PR is fixing a bug area: Bluetooth labels Jun 11, 2019
@Vudentz Vudentz requested a review from asbjornsabo June 11, 2019 08:00
@Vudentz Vudentz force-pushed the bluetooth branch 2 times, most recently from 72794a2 to fe4b1fb Compare June 11, 2019 08:57
Although unlikely it is possible that a remote may attempt to send just
1 byte as the write request allows to do that:

BLUETOOTH CORE SPECIFICATION Version 5.1 | Vol 3, Part F
page 2320:

  'If the attribute value has a fixed length and the Attribute Value
  parameter length is less than or equal to the length of the attribute
  value, the octets of the attribute value parameter length shall be
  written; all other octets in this attribute value shall be
  unchanged.'

Fixes zephyrproject-rtos#16734

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: Bluetooth bug The issue is a bug, or the PR is fixing a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bluetooth: GATT: Writing 1 byte to a CCC access invalid memory

3 participants