While value has more than single MTU can carry long read procedure will
be triggered. In such cases offset need to bo considered while getting
value from storage.
---
client/gatt.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 47 insertions(+), 2 deletions(-)
diff --git a/client/gatt.c b/client/gatt.c
index 8c818d8c1..7a6035ac1 100644
--- a/client/gatt.c
+++ b/client/gatt.c
@@ -1412,6 +1412,39 @@ static const GDBusPropertyTable chrc_properties[] = {
{ }
};
+static int parse_offset(DBusMessageIter *iter, uint16_t *offset)
+{
+ DBusMessageIter dict;
+
+ if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
+ return -EINVAL;
+
+ dbus_message_iter_recurse(iter, &dict);
+
+ while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
+ const char *key;
+ DBusMessageIter value, entry;
+ int var;
+
+ dbus_message_iter_recurse(&dict, &entry);
+ dbus_message_iter_get_basic(&entry, &key);
+
+ dbus_message_iter_next(&entry);
+ dbus_message_iter_recurse(&entry, &value);
+
+ var = dbus_message_iter_get_arg_type(&value);
+ if (strcasecmp(key, "offset") == 0) {
+ if (var != DBUS_TYPE_UINT16)
+ return -EINVAL;
+ dbus_message_iter_get_basic(&value, offset);
+ }
+
+ dbus_message_iter_next(&dict);
+ }
+
+ return 0;
+}
+
static DBusMessage *read_value(DBusMessage *msg, uint8_t *value,
uint16_t value_len)
{
@@ -1433,8 +1466,14 @@ static DBusMessage *chrc_read_value(DBusConnection *conn, DBusMessage *msg,
void *user_data)
{
struct chrc *chrc = user_data;
+ DBusMessageIter iter;
+ uint16_t offset = 0;
+
+ dbus_message_iter_init(msg, &iter);
+
+ parse_offset(&iter, &offset);
- return read_value(msg, chrc->value, chrc->value_len);
+ return read_value(msg, &chrc->value[offset], chrc->value_len - offset);
}
static int parse_value_arg(DBusMessageIter *iter, uint8_t **value, int *len)
@@ -1785,8 +1824,14 @@ static DBusMessage *desc_read_value(DBusConnection *conn, DBusMessage *msg,
void *user_data)
{
struct desc *desc = user_data;
+ DBusMessageIter iter;
+ uint16_t offset = 0;
+
+ dbus_message_iter_init(msg, &iter);
+
+ parse_offset(&iter, &offset);
- return read_value(msg, desc->value, desc->value_len);
+ return read_value(msg, &desc->value[offset], desc->value_len - offset);
}
static DBusMessage *desc_write_value(DBusConnection *conn, DBusMessage *msg,
--
2.13.6
This patch adds invalid offset handlers to read callbacks of attributes.
---
client/gatt.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/client/gatt.c b/client/gatt.c
index 7a6035ac1..4eff38af6 100644
--- a/client/gatt.c
+++ b/client/gatt.c
@@ -1473,6 +1473,10 @@ static DBusMessage *chrc_read_value(DBusConnection *conn, DBusMessage *msg,
parse_offset(&iter, &offset);
+ if (offset >= chrc->value_len)
+ return g_dbus_create_error(msg, "org.bluez.Error.InvalidOffset",
+ NULL);
+
return read_value(msg, &chrc->value[offset], chrc->value_len - offset);
}
@@ -1831,6 +1835,10 @@ static DBusMessage *desc_read_value(DBusConnection *conn, DBusMessage *msg,
parse_offset(&iter, &offset);
+ if (offset >= desc->value_len)
+ return g_dbus_create_error(msg, "org.bluez.Error.InvalidOffset",
+ NULL);
+
return read_value(msg, &desc->value[offset], desc->value_len - offset);
}
--
2.13.6
This patch adds handling of invalid offset error for gatt database in
case if offset in read blob would be invalid.
"The Read Blob Request is repeated until the Read Blob Response’s Part
Attribute Value parameter is zero or an Error Response is sent by the server
with the Error Code set to Invalid Offset." Bluetooth Core 5.0, 4.12.2
"If the prepare Value Offset is greater than the current length of the attribute
value then all pending prepare write values shall be discarded for this client,
the queue shall be cleared and then an Error Response shall be sent with the
«Invalid Offset»." Bluetooth Core 5.0, 3.4.6.3
---
doc/gatt-api.txt | 1 +
src/gatt-database.c | 3 +++
2 files changed, 4 insertions(+)
diff --git a/doc/gatt-api.txt b/doc/gatt-api.txt
index ccf3a8b6d..3f542b5eb 100644
--- a/doc/gatt-api.txt
+++ b/doc/gatt-api.txt
@@ -74,6 +74,7 @@ Methods array{byte} ReadValue(dict options)
org.bluez.Error.InProgress
org.bluez.Error.NotPermitted
org.bluez.Error.NotAuthorized
+ org.bluez.Error.InvalidOffset
org.bluez.Error.NotSupported
void WriteValue(array{byte} value, dict options)
diff --git a/src/gatt-database.c b/src/gatt-database.c
index 9a33ae7f9..8e09a6a40 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -1649,6 +1649,9 @@ static uint8_t dbus_error_to_att_ecode(const char *error_name)
if (strcmp(error_name, "org.bluez.Error.InvalidValueLength") == 0)
return BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN;
+ if (strcmp(error_name, "org.bluez.Error.InvalidOffset") == 0)
+ return BT_ATT_ERROR_INVALID_OFFSET;
+
if (strcmp(error_name, "org.bluez.Error.InProgress") == 0)
return BT_ERROR_ALREADY_IN_PROGRESS;
--
2.13.6