Diff between a9249eece7300d4e23ed8c6c5b5f10c5029db750 and 88cdd5749c491ea26c080f79e1ac5b76b711f32b

Changed Files

File Additions Deletions Status
attrib/att.c +9 -0 modified

Full Patch

diff --git a/attrib/att.c b/attrib/att.c
index d367918..c279b2c 100644
--- a/attrib/att.c
+++ b/attrib/att.c
@@ -334,12 +334,21 @@ GSList *dec_find_by_type_resp(const uint8_t *pdu, size_t len)
 	GSList *matches;
 	off_t offset;
 
+	/* PDU should contain at least:
+	 * - Attribute Opcode (1 octet)
+	 * - Handles Information List (at least one entry):
+	 *   - Found Attribute Handle (2 octets)
+	 *   - Group End Handle (2 octets) */
 	if (pdu == NULL || len < 5)
 		return NULL;
 
 	if (pdu[0] != ATT_OP_FIND_BY_TYPE_RESP)
 		return NULL;
 
+	/* Reject incomplete Handles Information List */
+	if ((len - 1) % 4)
+		return NULL;
+
 	for (offset = 1, matches = NULL;
 				len >= (offset + sizeof(uint16_t) * 2);
 				offset += sizeof(uint16_t) * 2) {