From 799be9fa3a20c2ce606e3dd4f4b1242561fe8364 Mon Sep 17 00:00:00 2001
From: Tian Hao <tianhao@espressif.com>
Date: Tue, 17 Jan 2017 18:42:11 +0800
Subject: [PATCH] component/bt : fix gatt server table bugs

1. fix gatt server table bugs
2. fix blufi a minor bug
---
 .../btc/profile/esp/blufi/blufi_prf.c         |  2 +-
 components/bt/bluedroid/stack/gatt/gatt_db.c  | 22 +++++++++----------
 components/bt/bluedroid/stack/gatt/gatt_sr.c  |  2 +-
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
index 7866ca0f80..15b4ccf5a9 100644
--- a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
@@ -198,7 +198,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
             BTA_GATTS_AddCharacteristic(blufi_env.handle_srvc, &blufi_char_uuid_e2p,
                                         (GATT_PERM_READ),
-                                        (GATT_PERM_READ | GATT_CHAR_PROP_BIT_NOTIFY),
+                                        (GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_NOTIFY),
                                         NULL, NULL);
             break;
          case BLUFI_CHAR_E2P_UUID:  /* ESP32 to Phone */
diff --git a/components/bt/bluedroid/stack/gatt/gatt_db.c b/components/bt/bluedroid/stack/gatt/gatt_db.c
index fd27959d96..a574b5d1ed 100644
--- a/components/bt/bluedroid/stack/gatt/gatt_db.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_db.c
@@ -651,27 +651,28 @@ tGATT_STATUS gatts_set_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
                 case GATT_UUID_INCLUDE_SERVICE:
                     return GATT_NOT_FOUND;
                 default:
-                    if (p_cur->p_value->attr_val.attr_max_len < length) {
+                    if (p_cur->p_value != NULL && p_cur->p_value->attr_val.attr_max_len < length) {
                         GATT_TRACE_ERROR("gatts_set_attribute_vaule failt:Invalid value length");
                         return GATT_INVALID_ATTR_LEN;
-                    } else {
+                    } else if (p_cur->p_value != NULL && p_cur->p_value->attr_val.attr_max_len > 0) {
                         memcpy(p_cur->p_value->attr_val.attr_val, value, length);
                         p_cur->p_value->attr_val.attr_len = length;
+                    } else {
+                        return GATT_INVALID_ATTR_LEN;
                     }
                     break;
                 }
             } else {
-                if (p_cur->p_value->attr_val.attr_max_len < length) {
+                if (p_cur->p_value != NULL && p_cur->p_value->attr_val.attr_max_len < length) {
                     GATT_TRACE_ERROR("gatts_set_attribute_vaule failt:Invalid value length");
-                } else {
+                } else if (p_cur->p_value != NULL && p_cur->p_value->attr_val.attr_max_len > 0) {
                     memcpy(p_cur->p_value->attr_val.attr_val, value, length);
                     p_cur->p_value->attr_val.attr_len = length;
+                } else {
+                    return GATT_INVALID_ATTR_LEN;
                 }
-
             }
-
             break;
-
         }
 
         p_cur = p_cur->p_next;
@@ -699,8 +700,9 @@ tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
                                        UINT16 *length, UINT8 **value)
 {
     tGATT_ATTR16  *p_cur;
-    GATT_TRACE_DEBUG("***********%s*************\n", __func__);
+
     GATT_TRACE_DEBUG("attr_handle = %x\n", attr_handle);
+
     if (p_db == NULL) {
         GATT_TRACE_ERROR("gatts_get_attribute_value Fail:p_db is NULL.\n");
         return GATT_INVALID_PDU;
@@ -713,7 +715,6 @@ tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
     p_cur    =  (tGATT_ATTR16 *) p_db->p_attr_list;
 
     while (p_cur != NULL) {
-        LOG_ERROR("p_ur->handle = %x\n", p_cur->handle);
         if (p_cur->handle == attr_handle) {
 
             if (p_cur->uuid_type == GATT_ATTR_UUID_TYPE_16) {
@@ -722,7 +723,7 @@ tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
                 case GATT_UUID_INCLUDE_SERVICE:
                     break;
                 default:
-                    if (p_cur->p_value->attr_val.attr_len != 0) {
+                    if (p_cur->p_value &&  p_cur->p_value->attr_val.attr_len != 0) {
                         *length = p_cur->p_value->attr_val.attr_len;
                         *value = p_cur->p_value->attr_val.attr_val;
                         return GATT_SUCCESS;
@@ -748,7 +749,6 @@ tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
 
         }
 
-
         p_cur = p_cur->p_next;
     }
 
diff --git a/components/bt/bluedroid/stack/gatt/gatt_sr.c b/components/bt/bluedroid/stack/gatt/gatt_sr.c
index a817ad1478..a7ee3b5ad0 100644
--- a/components/bt/bluedroid/stack/gatt/gatt_sr.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_sr.c
@@ -1159,7 +1159,7 @@ static void gatts_process_read_req(tGATT_TCB *p_tcb, tGATT_SR_REG *p_rcb, UINT8
             gatt_send_error_rsp (p_tcb, reason, op_code, handle, FALSE);
             gatt_dequeue_sr_cmd(p_tcb);
         }
-    } else {
+    } else if (reason == GATT_SUCCESS || reason == GATT_STACK_RSP) {
         attp_send_sr_msg(p_tcb, p_msg);
         gatt_dequeue_sr_cmd(p_tcb);
     }
-- 
2.40.0