Skip to content

Commit 542b725

Browse files
committed
BLE: Fix incorrect index used to access attsCb.prepWriteQueue in Cordio
The connection id starts at the value 1. The entry accessed in the array should be connId - 1
1 parent 8d9dabe commit 542b725

File tree

2 files changed

+5
-5
lines changed

2 files changed

+5
-5
lines changed

connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/atts_main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ void attsClearPrepWrites(attsCcb_t *pCcb)
366366
{
367367
void *pBuf;
368368

369-
while ((pBuf = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId])) != NULL)
369+
while ((pBuf = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId - 1])) != NULL)
370370
{
371371
WsfBufFree(pBuf);
372372
}

connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/atts_write.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ void attsProcPrepWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
265265
err = ATT_ERR_LENGTH;
266266
}
267267
/* verify prepare write queue limit not reached */
268-
else if (WsfQueueCount(&attsCb.prepWriteQueue[pCcb->connId]) >= pAttCfg->numPrepWrites)
268+
else if (WsfQueueCount(&attsCb.prepWriteQueue[pCcb->connId - 1]) >= pAttCfg->numPrepWrites)
269269
{
270270
err = ATT_ERR_QUEUE_FULL;
271271
}
@@ -288,7 +288,7 @@ void attsProcPrepWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
288288
pPrep->handle = handle;
289289
pPrep->offset = offset;
290290
memcpy(pPrep->packet, pPacket, writeLen);
291-
WsfQueueEnq(&attsCb.prepWriteQueue[pCcb->connId], pPrep);
291+
WsfQueueEnq(&attsCb.prepWriteQueue[pCcb->connId - 1], pPrep);
292292

293293
/* allocate response buffer */
294294
if ((pBuf = attMsgAlloc(L2C_PAYLOAD_START + ATT_PREP_WRITE_RSP_LEN + writeLen)) != NULL)
@@ -342,7 +342,7 @@ void attsProcExecWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
342342
else if (*pPacket == ATT_EXEC_WRITE_ALL)
343343
{
344344
/* iterate over prepare write queue and verify offset and length */
345-
for (pPrep = attsCb.prepWriteQueue[pCcb->connId].pHead; pPrep != NULL; pPrep = pPrep->pNext)
345+
for (pPrep = attsCb.prepWriteQueue[pCcb->connId - 1].pHead; pPrep != NULL; pPrep = pPrep->pNext)
346346
{
347347
/* find attribute */
348348
if ((pAttr = attsFindByHandle(pPrep->handle, &pGroup)) != NULL)
@@ -371,7 +371,7 @@ void attsProcExecWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
371371
if (err == ATT_SUCCESS)
372372
{
373373
/* for each buffer */
374-
while ((pPrep = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId])) != NULL)
374+
while ((pPrep = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId - 1])) != NULL)
375375
{
376376
/* write buffer */
377377
if ((err = attsExecPrepWrite(pCcb, pPrep)) != ATT_SUCCESS)

0 commit comments

Comments
 (0)