[PATCH 2/2] shared/gatt-server: Fix notification & indication packet size

[Romain Izard <romain.izard.pro@gmail.com>]

For both Handle Value Notification & Handle Value Indication, the size
of the payload is limited to (ATT_MTU - 3) bytes, as indicated in Vol 3,
part F, section 3.4.7.1 & 3.4.7.2 of the Bluetooth 4.2 specification.

In the function, the first reserved byte is implicit and corresponds to
the opcode, while the 2 next bytes are explicit and contain the
attribute handle.

Ensure that the truncation of large payloads is done with the correct
value.
---
 src/shared/gatt-server.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index dd9c88f..c7974fb 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -1500,7 +1500,7 @@ bool bt_gatt_server_send_notification(struct bt_gatt_server *server,
 	if (!server || (length && !value))
 		return false;
 
-	pdu_len = MIN(bt_att_get_mtu(server->att), length + 2);
+	pdu_len = MIN(bt_att_get_mtu(server->att) - 1, length + 2);
 	pdu = malloc(pdu_len);
 	if (!pdu)
 		return false;
@@ -1555,7 +1555,7 @@ bool bt_gatt_server_send_indication(struct bt_gatt_server *server,
 	if (!server || (length && !value))
 		return false;
 
-	pdu_len = MIN(bt_att_get_mtu(server->att), length + 2);
+	pdu_len = MIN(bt_att_get_mtu(server->att) - 1, length + 2);
 	pdu = malloc(pdu_len);
 	if (!pdu)
 		return false;
-- 
2.1.0