Possible bug in BLE function

[DS.4]

STM32WB.

V11.1

function:

aci_gatt_add_service
 

In the function we copy the Service_UUID struct to buffer according to size.

UUID can be either a short 2 BYTES or long array of 16 BYTES.

Issue: In case it is 16 BYTES, It looks to be copying 2 BYTES from the short UUID , and 14 BYTES from the long UUID.

Here:

Osal_MemCpy( (void*)&cp0->Service_UUID, (const void*)Service_UUID, size );

Is it a bug? or am I missing something?

Full function:

tBleStatus aci_gatt_add_service( uint8_t Service_UUID_Type,
 const Service_UUID_t* Service_UUID,
 uint8_t Service_Type,
 uint8_t Max_Attribute_Records,
 uint16_t* Service_Handle )
{
 struct hci_request rq;
 uint8_t cmd_buffer[BLE_CMD_MAX_PARAM_LEN];
 aci_gatt_add_service_cp0 *cp0 = (aci_gatt_add_service_cp0*)(cmd_buffer);
 aci_gatt_add_service_cp1 *cp1 = (aci_gatt_add_service_cp1*)(cmd_buffer + 1 + (Service_UUID_Type == 1 ? 2 : (Service_UUID_Type == 2 ? 16 : 0)));
 aci_gatt_add_service_rp0 resp;
 Osal_MemSet( &resp, 0, sizeof(resp) );
 int index_input = 0;
 cp0->Service_UUID_Type = Service_UUID_Type;
 index_input += 1;
 /* var_len_data input */
 {
 uint8_t size;
 switch ( Service_UUID_Type )
 {
 case 1: size = 2; break;
 case 2: size = 16; break;
 default: return BLE_STATUS_ERROR;
 }
 Osal_MemCpy( (void*)&cp0->Service_UUID, (const void*)Service_UUID, size );
 index_input += size;
 {
 cp1->Service_Type = Service_Type;
 }
 index_input += 1;
 {
 cp1->Max_Attribute_Records = Max_Attribute_Records;
 }
 index_input += 1;
 }
 Osal_MemSet( &rq, 0, sizeof(rq) );
 rq.ogf = 0x3f;
 rq.ocf = 0x102;
 rq.cparam = cmd_buffer;
 rq.clen = index_input;
 rq.rparam = &resp;
 rq.rlen = sizeof(resp);
 if ( hci_send_req(&rq, FALSE) < 0 )
 return BLE_STATUS_TIMEOUT;
 if ( resp.Status )
 return resp.Status;
 *Service_Handle = resp.Service_Handle;
 return BLE_STATUS_SUCCESS;
}

[Guillaume K]

I don't see an issue.

Why do you say that

 Osal_MemCpy( (void*)&cp0->Service_UUID, (const void*)Service_UUID, size );

copies 2 BYTES from the short UUID , and 14 BYTES from the long UUID ?

Could you explain more ?

[DS.4]

Just the way Service_UUID is defined.

/* Definition of Service_UUID_t */
typedef PACKED(union)
{
 /**
 * 16-bit UUID
 */
 uint16_t Service_UUID_16;
 /**
 * 128-bit UUID
 */
 uint8_t Service_UUID_128[16];
} Service_UUID_t;

Copying 'size', that can be either 2 or 16, But always from the start of the struct...

[Guillaume K]

it's a C union. both members of Service_UUID_t are in fact at the same memory location.