From 0cb30a3da08a5b89a9f98587ca4f5a0fa94c7035 Mon Sep 17 00:00:00 2001 From: chenjianhua Date: Wed, 19 Oct 2022 20:47:44 +0800 Subject: [PATCH] bluedroid: correct the length of att read by type pdu --- components/bt/host/bluedroid/stack/gatt/att_protocol.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/components/bt/host/bluedroid/stack/gatt/att_protocol.c b/components/bt/host/bluedroid/stack/gatt/att_protocol.c index 52ac13da1e..c6bb441105 100644 --- a/components/bt/host/bluedroid/stack/gatt/att_protocol.c +++ b/components/bt/host/bluedroid/stack/gatt/att_protocol.c @@ -134,8 +134,10 @@ BT_HDR *attp_build_browse_cmd(UINT8 op_code, UINT16 s_hdl, UINT16 e_hdl, tBT_UUI { BT_HDR *p_buf = NULL; UINT8 *p; + /* length of ATT_READ_BY_TYPE_REQ PDU: opcode(1) + start_handle (2) + end_handle (2) + uuid (2 or 16) */ + const UINT8 payload_size = 1 + 2 + 2 + ((uuid.len == LEN_UUID_16) ? LEN_UUID_16 : LEN_UUID_128); - if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + 8 + L2CAP_MIN_OFFSET)) != NULL) { + if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET)) != NULL) { p = (UINT8 *)(p_buf + 1) + L2CAP_MIN_OFFSET; /* Describe the built message location and size */ p_buf->offset = L2CAP_MIN_OFFSET;