2014-04-01 17:33:30

by Claudio Takahasi

Subject: [PATCH BlueZ v0] attrib: Improve Attribute Data length checking

According to Core SPEC, attribute data list must be grouped in elements
of the same size.
---
attrib/gatt.c | 40 +++++++++++++++++-----------------------
1 file changed, 17 insertions(+), 23 deletions(-)

diff --git a/attrib/gatt.c b/attrib/gatt.c
index 5ae20f4..49cd1a3 100644
--- a/attrib/gatt.c
+++ b/attrib/gatt.c
@@ -254,6 +254,16 @@ static void primary_all_cb(guint8 status, const guint8 *ipdu, guint16 iplen,
goto done;
}

+ if (list->len == 6)
+ type = BT_UUID16;
+ else if (list->len == 20)
+ type = BT_UUID128;
+ else {
+ att_data_list_free(list);
+ err = ATT_ECODE_INVALID_PDU;
+ goto done;
+ }
+
for (i = 0, end = 0; i < list->num; i++) {
const uint8_t *data = list->data[i];
struct gatt_primary *primary;
@@ -262,19 +272,6 @@ static void primary_all_cb(guint8 status, const guint8 *ipdu, guint16 iplen,
start = get_le16(&data[0]);
end = get_le16(&data[2]);

- /*
- * FIXME: Check before "for". Elements in the Attribute
- * Data List have the same length (list->len).
- */
- if (list->len == 6)
- type = BT_UUID16;
- else if (list->len == 20)
- type = BT_UUID128;
- else {
- /* Skipping invalid data */
- continue;
- }
-
get_uuid128(type, &data[4], &uuid128);

primary = g_try_new0(struct gatt_primary, 1);
@@ -507,6 +504,7 @@ static void char_discovered_cb(guint8 status, const guint8 *ipdu, guint16 iplen,
struct att_data_list *list;
unsigned int i, err = ATT_ECODE_ATTR_NOT_FOUND;
uint16_t last = 0;
+ uint8_t type;

if (status) {
err = status;
@@ -519,23 +517,18 @@ static void char_discovered_cb(guint8 status, const guint8 *ipdu, guint16 iplen,
goto done;
}

+ if (list->len == 7)
+ type = BT_UUID16;
+ else
+ type = BT_UUID128;
+
for (i = 0; i < list->num; i++) {
uint8_t *value = list->data[i];
struct gatt_char *chars;
bt_uuid_t uuid128;
- uint8_t type;

last = get_le16(value);

- /*
- * FIXME: Check before "for". Elements in the Attribute
- * Data List have the same length (list->len).
- */
- if (list->len == 7)
- type = BT_UUID16;
- else
- type = BT_UUID128;
-
get_uuid128(type, &value[5], &uuid128);

if (dc->uuid && bt_uuid_cmp(dc->uuid, &uuid128))
@@ -543,6 +536,7 @@ static void char_discovered_cb(guint8 status, const guint8 *ipdu, guint16 iplen,

chars = g_try_new0(struct gatt_char, 1);
if (!chars) {
+ att_data_list_free(list);
err = ATT_ECODE_INSUFF_RESOURCES;
goto done;
}
--
1.8.3.1

2014-04-03 07:22:38

by Johan Hedberg

Subject: Re: [PATCH BlueZ v0] attrib: Improve Attribute Data length checking

Hi Claudio,

On Tue, Apr 01, 2014, Claudio Takahasi wrote:
> According to Core SPEC, attribute data list must be grouped in elements
> of the same size.
> ---
> attrib/gatt.c | 40 +++++++++++++++++-----------------------
> 1 file changed, 17 insertions(+), 23 deletions(-)

Applied. Thanks.

Johan