diff options
| -rw-r--r-- | stack/gatt/gatt_sr.cc | 3 | ||||
| -rw-r--r-- | stack/l2cap/l2c_ble.cc | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/stack/gatt/gatt_sr.cc b/stack/gatt/gatt_sr.cc index 9fe642cba..0396bb16f 100644 --- a/stack/gatt/gatt_sr.cc +++ b/stack/gatt/gatt_sr.cc @@ -173,6 +173,9 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { if (p_rsp != NULL) { total_len = (p_buf->len + p_rsp->attr_value.len); + if (p_cmd->multi_req.variable_len) { + total_len += 2; + } if (total_len > mtu) { /* just send the partial response for the overflow case */ diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc index 16454a5b0..d5486794d 100644 --- a/stack/l2cap/l2c_ble.cc +++ b/stack/l2cap/l2c_ble.cc @@ -621,7 +621,7 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) { break; } case L2CAP_CMD_CREDIT_BASED_CONN_RES: - if (p + 2 > p_pkt_end) { + if (p + 8 > p_pkt_end) { LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len"; return; } |