[esp32_ble_server] fix infinitely large characteristic value (#14011)

This commit is contained in:
Rodrigo Martín
2026-02-17 18:45:21 +01:00
committed by GitHub
parent e826d71bd8
commit 81ed70325c
3 changed files with 24 additions and 7 deletions

View File

@@ -527,7 +527,7 @@ async def to_code_characteristic(service_var, char_conf):
action_conf,
char_conf[CONF_CHAR_VALUE_ACTION_ID_],
cg.TemplateArguments(),
{},
[],
)
cg.add(value_action.play())
else:

View File

@@ -246,9 +246,27 @@ void BLECharacteristic::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt
if (this->handle_ != param->write.handle)
break;
esp_gatt_status_t status = ESP_GATT_OK;
if (param->write.is_prep) {
this->value_.insert(this->value_.end(), param->write.value, param->write.value + param->write.len);
this->write_event_ = true;
const size_t offset = param->write.offset;
const size_t write_len = param->write.len;
const size_t new_size = offset + write_len;
// Clean the buffer on the first prepared write event
if (offset == 0) {
this->value_.clear();
}
if (offset != this->value_.size()) {
status = ESP_GATT_INVALID_OFFSET;
} else if (new_size > ESP_GATT_MAX_ATTR_LEN) {
status = ESP_GATT_INVALID_ATTR_LEN;
} else {
if (this->value_.size() < new_size) {
this->value_.resize(new_size);
}
memcpy(this->value_.data() + offset, param->write.value, write_len);
}
} else {
this->set_value(ByteBuffer::wrap(param->write.value, param->write.len));
}
@@ -263,7 +281,7 @@ void BLECharacteristic::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt
memcpy(response.attr_value.value, param->write.value, param->write.len);
esp_err_t err =
esp_ble_gatts_send_response(gatts_if, param->write.conn_id, param->write.trans_id, ESP_GATT_OK, &response);
esp_ble_gatts_send_response(gatts_if, param->write.conn_id, param->write.trans_id, status, &response);
if (err != ESP_OK) {
ESP_LOGE(TAG, "esp_ble_gatts_send_response failed: %d", err);
@@ -280,9 +298,9 @@ void BLECharacteristic::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt
}
case ESP_GATTS_EXEC_WRITE_EVT: {
if (!this->write_event_)
// BLE stack will guarantee that ESP_GATTS_EXEC_WRITE_EVT is only received after prepared writes
if (this->value_.empty())
break;
this->write_event_ = false;
if (param->exec_write.exec_write_flag == ESP_GATT_PREP_WRITE_EXEC) {
if (this->on_write_callback_) {
(*this->on_write_callback_)(this->value_, param->exec_write.conn_id);

View File

@@ -77,7 +77,6 @@ class BLECharacteristic {
}
protected:
bool write_event_{false};
BLEService *service_{};
ESPBTUUID uuid_;
esp_gatt_char_prop_t properties_;