shared/gatt-server: Fix not allowing valid attribute writes
authorBart Philips <bartphilips1@gmail.com>
Wed, 9 Aug 2023 20:27:23 +0000 (22:27 +0200)
committerAyush Garg <ayush.garg@samsung.com>
Fri, 5 Jan 2024 13:34:03 +0000 (19:04 +0530)
The length check shall not consider the command header, just its
payload.

src/shared/gatt-server.c

index 6a8380c..48cfbbf 100644 (file)
@@ -898,7 +898,7 @@ static void write_cb(struct bt_att_chan *chan, uint8_t opcode, const void *pdu,
        if (ecode)
                goto error;
 #else
-       ecode = check_length(length, 0);
+       ecode = check_length(length - 2, 0);
        if (ecode)
                goto error;
 #endif
@@ -1484,7 +1484,7 @@ static void prep_write_cb(struct bt_att_chan *chan, uint8_t opcode,
        if (ecode)
                goto error;
 #else
-       ecode = check_length(length, offset);
+       ecode = check_length(length - 4, offset);
        if (ecode)
                goto error;
 #endif