Merge branch 'fix/uaf_in_bluedroid_attp_v5.5' into 'release/v5.5'

fix(ble): fixed use-after-free in bluedroid attp (v5.5)

See merge request espressif/esp-idf!45159
This commit is contained in:
Island
2026-01-19 14:15:21 +08:00
@@ -395,8 +395,7 @@ tGATT_STATUS attp_send_msg_to_l2cap(tGATT_TCB *p_tcb, BT_HDR *p_toL2CAP)
}
if (l2cap_ret == L2CAP_DW_FAILED) {
GATT_TRACE_DEBUG("ATT failed to pass msg:0x%0x to L2CAP",
*((UINT8 *)(p_toL2CAP + 1) + p_toL2CAP->offset));
GATT_TRACE_DEBUG("ATT failed to pass msg to L2CAP");
return GATT_INTERNAL_ERROR;
} else if (l2cap_ret == L2CAP_DW_CONGESTED) {
GATT_TRACE_DEBUG("ATT congested, message accepted");