Skip to content

wireless/bluetooth: Fix record stride in descriptor discovery response. - #20177

Merged
xiaoxiang781216 merged 1 commit into
apache:masterfrom
acassis:ble_nuttx
Sep 18, 2026
Merged

xiaoxiang781216 merged 1 commit into
apache:masterfrom
acassis:ble_nuttx

Conversation

@acassis

@acassis acassis commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

Summary

att_find_info_rsp() computed the per-record stride with sizeof(info.i16) and sizeof(info.i128), but "info" is a union of two pointers, so both expressions evaluate to the pointer width instead of the size of the record that the response format selects. The records are 4 octets for a 16-bit UUID and 18 octets for a 128-bit UUID, so the 128-bit path advanced by 4 (or 8) octets per iteration while reading an 18-octet record: handles and UUIDs were parsed from the wrong offsets and the walk ran past the end of the received PDU. On 64-bit builds the 16-bit path was wrong too.

Take the stride from the record structures, and require the response to carry whole records before walking it, since the loop advances one record at a time and a partial trailing record would be parsed as a whole one.

Improvement

Testing

before this patch:

att_find_info_rsp: handle 0x0010
btnet_discover_func: Discovered handle 10
att_find_info_rsp: handle 0x0706
btnet_discover_func: Discovered handle 706
Discovered 2 handles:

after this patch:

att_find_info_rsp: handle 0x0010
btnet_discover_func: Discovered handle 10
Discovered 1 handles:

@github-actions github-actions Bot added Area: Bluetooth Size: S The size of the change in this PR is small labels Sep 17, 2026
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown

MemBrowse Memory Report

No memory changes detected for:

att_find_info_rsp() computed the per-record stride with sizeof(info.i16)
and sizeof(info.i128), but "info" is a union of two pointers, so both
expressions evaluate to the pointer width instead of the size of the
record that the response format selects.  The records are 4 octets for a
16-bit UUID and 18 octets for a 128-bit UUID, so the 128-bit path
advanced by 4 (or 8) octets per iteration while reading an 18-octet
record: handles and UUIDs were parsed from the wrong offsets and the walk
ran past the end of the received PDU.  On 64-bit builds the 16-bit path
was wrong too.

Take the stride from the record structures, and require the response to
carry whole records before walking it, since the loop advances one record
at a time and a partial trailing record would be parsed as a whole one.

Ref: Core v6.0, Vol 3, Part F, 3.4.3.2 (ATT_FIND_INFORMATION_RSP)
Testing: sim:bluetooth builds with Make, no new warnings.  Not yet
exercised at runtime; the scriptable controller that can inject a
malformed Find Information Response is added separately.

Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Code Opus 5
@xiaoxiang781216
xiaoxiang781216 merged commit c95c546 into apache:master Sep 18, 2026
53 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: Bluetooth Size: S The size of the change in this PR is small

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants