From: Marcin Kraglak <marcin.kraglak@tieto.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH 4/4] android/gatt: Check for invalid handle errors
Date: Fri, 30 May 2014 07:51:14 +0200 [thread overview]
Message-ID: <1401429074-31535-4-git-send-email-marcin.kraglak@tieto.com> (raw)
In-Reply-To: <1401429074-31535-1-git-send-email-marcin.kraglak@tieto.com>
Check if handle or range is valid for server.
---
android/gatt.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/android/gatt.c b/android/gatt.c
index 48a32ec..8ccbad9 100644
--- a/android/gatt.c
+++ b/android/gatt.c
@@ -4753,6 +4753,9 @@ static uint8_t read_by_group_type(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return ATT_ECODE_INVALID_PDU;
+ if (start > end || start == 0)
+ return ATT_ECODE_INVALID_HANDLE;
+
q = queue_new();
if (!q)
return ATT_ECODE_INSUFF_RESOURCES;
@@ -4806,7 +4809,7 @@ static uint8_t read_by_type(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return ATT_ECODE_INVALID_PDU;
- if (start > end)
+ if (start > end || start == 0)
return ATT_ECODE_INVALID_HANDLE;
q = queue_new();
@@ -4869,6 +4872,9 @@ static uint8_t read_request(const uint8_t *cmd, uint16_t cmd_len,
return ATT_ECODE_REQ_NOT_SUPP;
}
+ if (handle == 0)
+ return ATT_ECODE_INVALID_HANDLE;
+
data = new0(struct pending_request, 1);
if (!data)
return ATT_ECODE_INSUFF_RESOURCES;
@@ -4948,6 +4954,9 @@ static uint8_t find_info_handle(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return ATT_ECODE_INVALID_PDU;
+ if (start > end || start == 0)
+ return ATT_ECODE_INVALID_HANDLE;
+
q = queue_new();
if (!q)
return ATT_ECODE_UNLIKELY;
@@ -5017,6 +5026,9 @@ static uint8_t find_by_type_request(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return ATT_ECODE_INVALID_PDU;
+ if (start > end || start == 0)
+ return ATT_ECODE_INVALID_HANDLE;
+
q = queue_new();
if (!q)
return ATT_ECODE_UNLIKELY;
@@ -5070,6 +5082,9 @@ static void write_cmd_request(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return;
+ if (handle == 0)
+ return;
+
if (!gatt_db_has_attribute(gatt_db, handle))
return;
@@ -5099,6 +5114,9 @@ static void write_signed_cmd_request(const uint8_t *cmd, uint16_t cmd_len,
len = dec_signed_write_cmd(cmd, cmd_len, &handle, value, &vlen, s);
+ if (handle == 0)
+ return;
+
if (!gatt_db_has_attribute(gatt_db, handle))
return;
@@ -5142,6 +5160,9 @@ static uint8_t write_req_request(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return ATT_ECODE_INVALID_PDU;
+ if (handle == 0)
+ return ATT_ECODE_INVALID_HANDLE;
+
if (!gatt_db_has_attribute(gatt_db, handle))
return ATT_ECODE_ATTR_NOT_FOUND;
@@ -5193,6 +5214,9 @@ static uint8_t write_prep_request(const uint8_t *cmd, uint16_t cmd_len,
if (!len)
return ATT_ECODE_INVALID_PDU;
+ if (handle == 0)
+ return ATT_ECODE_INVALID_HANDLE;
+
if (!gatt_db_has_attribute(gatt_db, handle))
return ATT_ECODE_ATTR_NOT_FOUND;
--
1.9.0
prev parent reply other threads:[~2014-05-30 5:51 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-30 5:51 [PATCH 1/4] android/gatt: Fix parallel reading/writing attributes values from applications Marcin Kraglak
2014-05-30 5:51 ` [PATCH 2/4] shared/gatt: Add function to check if handle was found in database Marcin Kraglak
2014-05-30 8:32 ` Luiz Augusto von Dentz
2014-05-30 9:16 ` Szymon Janc
2014-05-30 5:51 ` [PATCH 3/4] android/gatt: Chack if given handle exists " Marcin Kraglak
2014-05-30 5:51 ` Marcin Kraglak [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1401429074-31535-4-git-send-email-marcin.kraglak@tieto.com \
--to=marcin.kraglak@tieto.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox