Skip to content

Commit a1970eb

Browse files
JordanYateshenrikbrixandersen
authored andcommitted
bluetooth: hci: spi: fix length check
The buffer length check was not updated with the change to the H4 header push location (changed in 6113230). As the complete buffer is now provided, a buffer of length `SPI_MAX_MSG_LEN` is now valid. Signed-off-by: Jordan Yates <jordan@embeint.com>
1 parent cdcdd10 commit a1970eb

File tree

2 files changed

+2
-4
lines changed

2 files changed

+2
-4
lines changed

drivers/bluetooth/hci/hci_spi_st.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -567,8 +567,7 @@ static int bt_spi_send(const struct device *dev, struct net_buf *buf)
567567

568568
LOG_DBG("");
569569

570-
/* Buffer needs an additional byte for type */
571-
if (buf->len >= SPI_MAX_MSG_LEN) {
570+
if (buf->len > SPI_MAX_MSG_LEN) {
572571
LOG_ERR("Message too long (%d)", buf->len);
573572
return -EINVAL;
574573
}

drivers/bluetooth/hci/spi.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -309,8 +309,7 @@ static int bt_spi_send(const struct device *dev, struct net_buf *buf)
309309

310310
LOG_DBG("");
311311

312-
/* Buffer needs an additional byte for type */
313-
if (buf->len >= SPI_MAX_MSG_LEN) {
312+
if (buf->len > SPI_MAX_MSG_LEN) {
314313
LOG_ERR("Message too long (%d)", buf->len);
315314
return -EINVAL;
316315
}

0 commit comments

Comments
 (0)