Skip to content

Commit acf9a34

Browse files
thekurtovich2zero
authored andcommitted
NimBLEScan increment m_callbackSent before callback.
Fixes heap corruption observed on CONFIG_HEAP_POISONING_COMPREHENSIVE.
1 parent 0e8a2c4 commit acf9a34

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

src/NimBLEScan.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -119,19 +119,19 @@ int NimBLEScan::handleGapEvent(ble_gap_event* event, void* arg) {
119119
}
120120

121121
if (!advertisedDevice->m_callbackSent) {
122-
pScan->m_pScanCallbacks->onDiscovered(advertisedDevice);
123122
advertisedDevice->m_callbackSent++;
123+
pScan->m_pScanCallbacks->onDiscovered(advertisedDevice);
124124
}
125125

126126
// If not active scanning or scan response is not available
127127
// or extended advertisement scanning, report the result to the callback now.
128128
if (pScan->m_scanParams.passive || !isLegacyAdv || !advertisedDevice->isScannable()) {
129-
pScan->m_pScanCallbacks->onResult(advertisedDevice);
130129
advertisedDevice->m_callbackSent++;
130+
pScan->m_pScanCallbacks->onResult(advertisedDevice);
131131
} else if (isLegacyAdv && event_type == BLE_HCI_ADV_RPT_EVTYPE_SCAN_RSP) {
132+
advertisedDevice->m_callbackSent++;
132133
// got the scan response report the full data.
133134
pScan->m_pScanCallbacks->onResult(advertisedDevice);
134-
advertisedDevice->m_callbackSent++;
135135
}
136136

137137
// If not storing results and we have invoked the callback, delete the device.

0 commit comments

Comments
 (0)