Bug fixed: CurieBle library, class BLECharacteristic allocates memory using an incorrect variable which may result in memory corruption if the memory size is bigger than 16 bytes.

SidLeung · Brian Baltz · commit 2b5a0402af94 · 2016-05-11T11:27:02.000-07:00
diff --git a/libraries/CurieBLE/src/BLECharacteristic.cpp b/libraries/CurieBLE/src/BLECharacteristic.cpp
@@ -37,7 +37,7 @@ BLECharacteristic::BLECharacteristic(const char* uuid,
     _presentation_format(NULL)
 {
     _value_size = maxLength > BLE_MAX_ATTR_DATA_LEN ? BLE_MAX_ATTR_DATA_LEN : maxLength;
-    _value = (unsigned char*)malloc(_value_length);
+    _value = (unsigned char*)malloc(_value_size);
 
     memset(_event_handlers, 0, sizeof(_event_handlers));
 }

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ BLECharacteristic::BLECharacteristic(const char* uuid,`
`37`	`37`	`_presentation_format(NULL)`
`38`	`38`	`{`
`39`	`39`	`_value_size = maxLength > BLE_MAX_ATTR_DATA_LEN ? BLE_MAX_ATTR_DATA_LEN : maxLength;`
`40`		`- _value = (unsigned char*)malloc(_value_length);`
	`40`	`+ _value = (unsigned char*)malloc(_value_size);`
`41`	`41`
`42`	`42`	`memset(_event_handlers, 0, sizeof(_event_handlers));`
`43`	`43`	`}`