gatt-server: Flush notify multiple buffer when full and fix overflow
authorSebastian Urban <surban@surban.net>
Sun, 13 Jun 2021 10:39:18 +0000 (12:39 +0200)
committerAyush Garg <ayush.garg@samsung.com>
Fri, 11 Mar 2022 13:38:35 +0000 (19:08 +0530)
commitfff590e4b43d04a5604c7122bd3094b604645466
tree6175142ebc371c443924621c0e95283637d43a36
parent63d7e0d152ffa002dfe0de434cab63f372876dee
gatt-server: Flush notify multiple buffer when full and fix overflow

This fixes the calculation of available buffer space in
bt_gatt_server_send_notification and sends pending notifications
immediately when there is no more room to add a notification.

Previously there was a buffer overflow caused by incorrect calculation
of available buffer space: data->offset can equal data->len
from a previous call to this function, leading
(data->len - data->offset) to underflow after data->offset += 2.

Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>
src/shared/gatt-server.c