Skip to content
Snippets Groups Projects
Commit 05f082f2 authored by Stanley Tng's avatar Stanley Tng
Browse files

Revert "Handle bad packet length in gatts_process_read_req"

This reverts commit f4ef07fb.
There will be a newer fix uploaded later.

Bug: 73172115
Test: None
parent f4ef07fb
No related branches found
No related tags found
No related merge requests found
......@@ -22,7 +22,6 @@
*
******************************************************************************/
#include <log/log.h>
#include "bt_target.h"
#include "bt_utils.h"
#include "osi/include/osi.h"
......@@ -943,19 +942,9 @@ void gatts_process_write_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el,
*/
static void gatts_process_read_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el,
uint8_t op_code, uint16_t handle,
uint16_t len, uint8_t* p_data) {
UNUSED_ATTR uint16_t len, uint8_t* p_data) {
size_t buf_len = sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET;
uint16_t offset = 0;
if (op_code == GATT_REQ_READ_BLOB && len < sizeof(uint16_t)) {
/* Error: packet length is too short */
LOG(ERROR) << __func__ << ": packet length=" << len
<< " too short. min=" << sizeof(uint16_t);
android_errorWriteWithInfoLog(0x534e4554, "73172115", -1, NULL, 0);
gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, 0, false);
return;
}
BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len);
if (op_code == GATT_REQ_READ_BLOB) STREAM_TO_UINT16(offset, p_data);
......@@ -977,7 +966,7 @@ static void gatts_process_read_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el,
if (reason != GATT_SUCCESS) {
osi_free(p_msg);
/* in theory BUSY is not possible(should already been checked), protected
/* in theroy BUSY is not possible(should already been checked), protected
* check */
if (reason != GATT_PENDING && reason != GATT_BUSY)
gatt_send_error_rsp(tcb, reason, op_code, handle, false);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment