Skip to content

Commit

Permalink
NimBLEScan increment m_callbackSent before callback.
Browse files Browse the repository at this point in the history
Fixes heap corruption observed on CONFIG_HEAP_POISONING_COMPREHENSIVE.
  • Loading branch information
thekurtovic authored and h2zero committed Jan 4, 2025
1 parent 0e8a2c4 commit acf9a34
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions src/NimBLEScan.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -119,19 +119,19 @@ int NimBLEScan::handleGapEvent(ble_gap_event* event, void* arg) {
}

if (!advertisedDevice->m_callbackSent) {
pScan->m_pScanCallbacks->onDiscovered(advertisedDevice);
advertisedDevice->m_callbackSent++;
pScan->m_pScanCallbacks->onDiscovered(advertisedDevice);
}

// If not active scanning or scan response is not available
// or extended advertisement scanning, report the result to the callback now.
if (pScan->m_scanParams.passive || !isLegacyAdv || !advertisedDevice->isScannable()) {
pScan->m_pScanCallbacks->onResult(advertisedDevice);
advertisedDevice->m_callbackSent++;
pScan->m_pScanCallbacks->onResult(advertisedDevice);
} else if (isLegacyAdv && event_type == BLE_HCI_ADV_RPT_EVTYPE_SCAN_RSP) {
advertisedDevice->m_callbackSent++;
// got the scan response report the full data.
pScan->m_pScanCallbacks->onResult(advertisedDevice);
advertisedDevice->m_callbackSent++;
}

// If not storing results and we have invoked the callback, delete the device.
Expand Down

0 comments on commit acf9a34

Please sign in to comment.