Add check for MTU=0

Adds a malloc function that wraps the get_mtu call and its size check
before allocating, and adds checks for MTU size elsewhere.

Signed-off-by: Trond Snekvik <trond@golioth.io>

Author: trond-snekvik

gateway/src/bt/cert.c

@@ -189,7 +189,15 @@ static int write_server_cert_characteristic(struct bt_conn *conn)
     struct golioth_node_info *node = get_node_info(conn);
     struct bt_gatt_write_params *params = &node->write_params;
     uint16_t server_cert_handle = node->attr_handles[GOLIOTH_GATT_ATTR_SERVER_CERT].value;
-    size_t len = bt_gatt_get_mtu(conn) - BT_ATT_OVERHEAD;
+
+    size_t mtu = bt_gatt_get_mtu(conn);
+    if (mtu < BT_ATT_OVERHEAD)
+    {
+        LOG_ERR("MTU too small: %d", mtu);
+        return -EIO;
+    }
+
+    size_t len = mtu - BT_ATT_OVERHEAD;
     enum golioth_ble_gatt_packetizer_result ret =
         golioth_ble_gatt_packetizer_get(node->packetizer, node->server_cert_scratch, &len);
 
@@ -288,7 +296,7 @@ static void gateway_server_cert_write_start(struct bt_conn *conn)
         return;
     }
 
-    node->server_cert_scratch = malloc(bt_gatt_get_mtu(conn) - BT_ATT_OVERHEAD);
+    node->server_cert_scratch = bt_gatt_mtu_malloc(conn);
     if (NULL == node->server_cert_scratch)
     {
         LOG_ERR("Could not allocate space for %s scratch buffer", "server cert");

gateway/src/bt/downlink.c

@@ -52,7 +52,14 @@ static int write_downlink_characteristic(struct bt_conn *conn)
     struct bt_gatt_write_params *params = &node->write_params;
     uint16_t downlink_handle = node->attr_handles[GOLIOTH_GATT_ATTR_DOWNLINK].value;
 
-    size_t len = bt_gatt_get_mtu(conn) - BT_ATT_OVERHEAD;
+    size_t mtu = bt_gatt_get_mtu(conn);
+    if (mtu < BT_ATT_OVERHEAD)
+    {
+        LOG_ERR("MTU too small: %d", mtu);
+        return -EIO;
+    }
+
+    size_t len = mtu - BT_ATT_OVERHEAD;
     enum golioth_ble_gatt_packetizer_result ret =
         golioth_ble_gatt_packetizer_get(node->packetizer, node->downlink_scratch, &len);
 
@@ -154,7 +161,7 @@ struct downlink_context *gateway_downlink_start(struct bt_conn *conn)
         return NULL;
     }
 
-    node->downlink_scratch = malloc(bt_gatt_get_mtu(conn) - BT_ATT_OVERHEAD);
+    node->downlink_scratch = bt_gatt_mtu_malloc(conn);
     if (NULL == node->downlink_scratch)
     {
         LOG_ERR("Could not allocate space for downlink scratch buffer");

gateway/src/bt/types.h

@@ -7,6 +7,7 @@
 #pragma once
 
 #include <stdint.h>
+#include <stdlib.h>
 #include <zephyr/bluetooth/gatt.h>
 
 #define BT_ATT_OVERHEAD 3 /* opcode (1) + handle (2) */
@@ -46,3 +47,19 @@ struct golioth_node_info
     struct device_cert_context *device_cert_ctx;
     struct server_cert_context *server_cert_ctx;
 };
+
+/**
+ * Allocate a buffer the size of the current MTU for GATT operations.
+ * @param conn Bluetooth connection
+ * @return Pointer to allocated buffer or NULL on failure
+ */
+static inline void *bt_gatt_mtu_malloc(struct bt_conn *conn)
+{
+    size_t mtu = bt_gatt_get_mtu(conn);
+    if (mtu < BT_ATT_OVERHEAD)
+    {
+        return NULL;
+    }
+
+    return malloc(mtu - BT_ATT_OVERHEAD);
+}

gateway/src/cert.c

@@ -68,6 +68,7 @@ int device_cert_finish(struct device_cert_context *context)
     status = golioth_gateway_device_cert_set(_client, context->buf, context->len, 5);
     if (status != GOLIOTH_OK)
     {
+        LOG_ERR("Failed to finish device cert: %d", status);
         return -EIO;
     }