From 93b933ff3de1b7694732529b5dbbeb66afca942a Mon Sep 17 00:00:00 2001 From: Romain Izard Date: Fri, 23 Jan 2015 15:25:16 +0100 Subject: [PATCH] shared/gatt-server: Fix notification & indication packet size For both Handle Value Notification & Handle Value Indication, the size of the payload is limited to (ATT_MTU - 3) bytes, as indicated in Vol 3, part F, section 3.4.7.1 & 3.4.7.2 of the Bluetooth 4.2 specification. In the function, the first reserved byte is implicit and corresponds to the opcode, while the 2 next bytes are explicit and contain the attribute handle. Ensure that the truncation of large payloads is done with the correct value. --- src/shared/gatt-server.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c index 2d9706e9e..8f7b5cd76 100644 --- a/src/shared/gatt-server.c +++ b/src/shared/gatt-server.c @@ -1500,7 +1500,7 @@ bool bt_gatt_server_send_notification(struct bt_gatt_server *server, if (!server || (length && !value)) return false; - pdu_len = MIN(bt_att_get_mtu(server->att), length + 2); + pdu_len = MIN(bt_att_get_mtu(server->att) - 1, length + 2); pdu = malloc(pdu_len); if (!pdu) return false; @@ -1555,7 +1555,7 @@ bool bt_gatt_server_send_indication(struct bt_gatt_server *server, if (!server || (length && !value)) return false; - pdu_len = MIN(bt_att_get_mtu(server->att), length + 2); + pdu_len = MIN(bt_att_get_mtu(server->att) - 1, length + 2); pdu = malloc(pdu_len); if (!pdu) return false; -- 2.47.3