nimble/gap: Fix accessing invalid field in LE Connection Complete event
If status is error all other fields are invalid and connection role
should be determined based on error code. This also adds sanity
check if BLE_HS_DEBUG is enabled to verify if upper layers are
correctly ignoring handle value in case of error.
@@ -323,8 +323,12 @@ ble_hs_hci_evt_le_conn_complete(uint8_t subevent, uint8_t *data, int len)
return BLE_HS_ECONTROLLER;
}
+ memset(&evt, 0, sizeof(evt));
+
evt.subevent_code = data[0];
evt.status = data[1];
+
+ if (evt.status == BLE_ERR_SUCCESS) {
evt.connection_handle = get_le16(data + 2);
evt.role = data[4];
evt.peer_addr_type = data[5];
@@ -345,17 +349,15 @@ ble_hs_hci_evt_le_conn_complete(uint8_t subevent, uint8_t *data, int len)
evt.conn_latency = get_le16(data + 14 + extended_offset);
evt.supervision_timeout = get_le16(data + 16 + extended_offset);
evt.master_clk_acc = data[18 + extended_offset];
-
- if (evt.status == 0) {
- if (evt.role != BLE_HCI_LE_CONN_COMPLETE_ROLE_MASTER &&
- evt.role != BLE_HCI_LE_CONN_COMPLETE_ROLE_SLAVE) {
-
- return BLE_HS_EBADDATA;
- }
+ } else {
+#if MYNEWT_VAL(BLE_HS_DEBUG)
+ evt.connection_handle = BLE_HS_CONN_HANDLE_NONE;
+#endif
}
#if MYNEWT_VAL(BLE_EXT_ADV)
- if (evt.role == BLE_HCI_LE_CONN_COMPLETE_ROLE_SLAVE) {
+ if (evt.status == BLE_ERR_DIR_ADV_TMO ||
+ evt.role == BLE_HCI_LE_CONN_COMPLETE_ROLE_SLAVE) {
/* store this until we get set terminated event with adv handle */
memcpy(&pend_conn_complete, &evt, sizeof(evt));
return 0;
