diff options
| author | Juha Vuolle <juha.vuolle@insta.fi> | 2022-06-27 10:16:28 +0300 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2022-06-28 10:05:45 +0000 |
| commit | ea0b5a3ea63da5bba528465c21bb4152067635e5 (patch) | |
| tree | 48a0d4b7d85a70bc46342cf2fe2bedb0e46b512b | |
| parent | 244b5ab7735d2f39e57241647ad4eb04bf0dd329 (diff) | |
Fix Bluez LE advertiser crash on large advertisement data
The calculation to count the number of service UUIDs that fit the 31
bytes resulted in choosing a number of services that doesn't fit,
ultimately leading to a memset() crash a bit later.
Fixes: QTBUG-104060
Change-Id: Iad170cfded7363f820a92230df27cdb57bce3814
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
Reviewed-by: Alex Blasche <alexander.blasche@qt.io>
(cherry picked from commit efc4541af0f02d254cabf82b3db0412e7b83682e)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
| -rw-r--r-- | src/bluetooth/qleadvertiser_bluez.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/bluetooth/qleadvertiser_bluez.cpp b/src/bluetooth/qleadvertiser_bluez.cpp index ebf75b9f..8d67df7c 100644 --- a/src/bluetooth/qleadvertiser_bluez.cpp +++ b/src/bluetooth/qleadvertiser_bluez.cpp @@ -222,7 +222,8 @@ static void addServicesData(AdvData &data, const QList<T> &services) return; constexpr auto sizeofT = static_cast<int>(sizeof(T)); // signed is more convenient const qsizetype spaceAvailable = sizeof data.data - data.length; - const qsizetype maxServices = (std::max)((spaceAvailable - 2) / sizeofT, services.size()); + // Determine how many services will be set, space may limit the number + const qsizetype maxServices = (std::min)((spaceAvailable - 2) / sizeofT, services.size()); if (maxServices <= 0) { qCWarning(QT_BT_BLUEZ) << "services data does not fit into advertising data packet"; return; |