gatt: Make use of gatt_db_attribute_set_fixed_length

This makes use of gatt_db_attribute_set_fixed_length so the database is
aware of the length of the values and perform bounds checking.

Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>

diff --git a/src/gatt-database.c b/src/gatt-database.c
index 2c6bb93..b1c265e 100644 (file)
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -164,12 +164,14 @@ struct notify {
        void *user_data;
 };
 
+#define CLI_FEAT_SIZE 1
+
 struct device_state {
        struct btd_gatt_database *db;
        bdaddr_t bdaddr;
        uint8_t bdaddr_type;
        unsigned int disc_id;
-       uint8_t cli_feat[1];
+       uint8_t cli_feat[CLI_FEAT_SIZE];
        bool change_aware;
        bool out_of_sync;
        struct queue *ccc_states;
@@ -792,18 +794,12 @@ static void gap_appearance_read_cb(struct gatt_db_attribute *attrib,
 
        dev_class = btd_adapter_get_class(database->adapter);
 
-       if (offset > 2) {
-               error = BT_ATT_ERROR_INVALID_OFFSET;
-               goto done;
-       }
-
        appearance[0] = dev_class & 0x00ff;
        appearance[1] = (dev_class >> 8) & 0x001f;
 
        len -= offset;
        value = len ? &appearance[offset] : NULL;
 
-done:
        gatt_db_attribute_read_result(attrib, id, error, value, len);
 }
 
@@ -957,7 +953,7 @@ static void database_add_record(struct btd_gatt_database *database,
 static void populate_gap_service(struct btd_gatt_database *database)
 {
        bt_uuid_t uuid;
-       struct gatt_db_attribute *service;
+       struct gatt_db_attribute *service, *attrib;
 
        /* Add the GAP service */
        bt_uuid16_create(&uuid, UUID_GAP);
@@ -976,7 +972,8 @@ static void populate_gap_service(struct btd_gatt_database *database)
         * Device Appearance characteristic.
         */
        bt_uuid16_create(&uuid, GATT_CHARAC_APPEARANCE);
-       gatt_db_service_add_characteristic(service, &uuid, BT_ATT_PERM_READ,
+       attrib = gatt_db_service_add_characteristic(service, &uuid,
+                                                       BT_ATT_PERM_READ,
                                                        BT_GATT_CHRC_PROP_READ,
                                                        gap_appearance_read_cb,
                                                        NULL, database);
@@ -984,12 +981,15 @@ static void populate_gap_service(struct btd_gatt_database *database)
 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
        /* Central address resolution characteristic */
        bt_uuid16_create(&uuid, GATT_CHARAC_CENTRAL_RPA_RESOLUTION);
-       gatt_db_service_add_characteristic(service, &uuid, BT_ATT_PERM_READ,
+       attrib = gatt_db_service_add_characteristic(service, &uuid,
+                                                       BT_ATT_PERM_READ,
                                                        BT_GATT_CHRC_PROP_READ,
                                                        gap_rpa_res_support_read_cb,
                                                        NULL, database);
 #endif
 
+       gatt_db_attribute_set_fixed_length(attrib, 2);
+
        gatt_db_service_set_active(service, true);
 
        database_add_record(database, service);
@@ -1011,11 +1011,6 @@ static void gatt_ccc_read_cb(struct gatt_db_attribute *attrib,
 
        DBG("CCC read called for handle: 0x%04x", handle);
 
-       if (offset) {
-               ecode = BT_ATT_ERROR_INVALID_OFFSET;
-               goto done;
-       }
-
        ccc = get_ccc_state(database, att, handle);
        if (!ccc) {
                ecode = BT_ATT_ERROR_UNLIKELY;
@@ -1221,6 +1216,8 @@ service_add_ccc(struct gatt_db_attribute *service,
                return NULL;
        }
 
+       gatt_db_attribute_set_fixed_length(ccc, 2);
+
        ccc_cb->handle = gatt_db_attribute_get_handle(ccc);
        ccc_cb->callback = write_callback;
        ccc_cb->destroy = destroy;
@@ -1286,11 +1283,6 @@ static void cli_feat_read_cb(struct gatt_db_attribute *attrib,
                goto done;
        }
 
-       if (offset >= sizeof(state->cli_feat)) {
-               ecode = BT_ATT_ERROR_INVALID_OFFSET;
-               goto done;
-       }
-
        len = sizeof(state->cli_feat) - offset;
        value = len ? &state->cli_feat[offset] : NULL;
 
@@ -1427,6 +1419,7 @@ static void populate_gatt_service(struct btd_gatt_database *database)
                                cli_feat_read_cb, cli_feat_write_cb,
                                database);
 
+       gatt_db_attribute_set_fixed_length(database->cli_feat, CLI_FEAT_SIZE);
 
        /* Only expose database hash chrc if supported */
        if (gatt_db_hash_support(database->db)) {
@@ -1434,6 +1427,7 @@ static void populate_gatt_service(struct btd_gatt_database *database)
                database->db_hash = gatt_db_service_add_characteristic(service,
                                &uuid, BT_ATT_PERM_READ, BT_GATT_CHRC_PROP_READ,
                                db_hash_read_cb, NULL, database);
+               gatt_db_attribute_set_fixed_length(database->db_hash, 16);
        }
 
        /* Only enable EATT if there is a socket listening */
@@ -1442,7 +1436,8 @@ static void populate_gatt_service(struct btd_gatt_database *database)
                database->eatt = gatt_db_service_add_characteristic(service,
                                &uuid, BT_ATT_PERM_READ, BT_GATT_CHRC_PROP_READ,
                                server_feat_read_cb, NULL, database);
-}
+               gatt_db_attribute_set_fixed_length(database->eatt, 1);
+       }
 
        gatt_db_service_set_active(service, true);
 
@@ -1473,12 +1468,15 @@ static void populate_devinfo_service(struct btd_gatt_database *database)
        service = gatt_db_add_service(database->db, &uuid, true, 3);
 
        if (btd_opts.did_source > 0) {
+               struct gatt_db_attribute *attrib;
+
                bt_uuid16_create(&uuid, GATT_CHARAC_PNP_ID);
-               gatt_db_service_add_characteristic(service, &uuid,
+               attrib = gatt_db_service_add_characteristic(service, &uuid,
                                                BT_ATT_PERM_READ,
                                                BT_GATT_CHRC_PROP_READ,
                                                device_info_read_pnp_id_cb,
                                                NULL, database);
+               gatt_db_attribute_set_fixed_length(attrib, 7);
        }
 
        gatt_db_service_set_active(service, true);