Possible bug in BLE function

[DS.4]

STM32WB.

V11.1

function:

aci_gatt_add_service
                       

In the function we copy the Service_UUID struct to buffer according to size.

UUID can be either a short 2 BYTES or long array of 16 BYTES.

Issue: In case it is 16 BYTES, It looks to be copying 2 BYTES from the short UUID , and 14 BYTES from the long UUID.

Here:

Osal_MemCpy( (void*)&cp0->Service_UUID, (const void*)Service_UUID, size );

Is it a bug? or am I missing something?

Full function:

tBleStatus aci_gatt_add_service( uint8_t Service_UUID_Type,
                                 const Service_UUID_t* Service_UUID,
                                 uint8_t Service_Type,
                                 uint8_t Max_Attribute_Records,
                                 uint16_t* Service_Handle )
{
  struct hci_request rq;
  uint8_t cmd_buffer[BLE_CMD_MAX_PARAM_LEN];
  aci_gatt_add_service_cp0 *cp0 = (aci_gatt_add_service_cp0*)(cmd_buffer);
  aci_gatt_add_service_cp1 *cp1 = (aci_gatt_add_service_cp1*)(cmd_buffer + 1 + (Service_UUID_Type == 1 ? 2 : (Service_UUID_Type == 2 ? 16 : 0)));
  aci_gatt_add_service_rp0 resp;
  Osal_MemSet( &resp, 0, sizeof(resp) );
  int index_input = 0;
  cp0->Service_UUID_Type = Service_UUID_Type;
  index_input += 1;
  /* var_len_data input */
  {
    uint8_t size;
    switch ( Service_UUID_Type )
    {
      case 1: size = 2; break;
      case 2: size = 16; break;
      default: return BLE_STATUS_ERROR;
    }
    Osal_MemCpy( (void*)&cp0->Service_UUID, (const void*)Service_UUID, size );
    index_input += size;
    {
      cp1->Service_Type = Service_Type;
    }
    index_input += 1;
    {
      cp1->Max_Attribute_Records = Max_Attribute_Records;
    }
    index_input += 1;
  }
  Osal_MemSet( &rq, 0, sizeof(rq) );
  rq.ogf = 0x3f;
  rq.ocf = 0x102;
  rq.cparam = cmd_buffer;
  rq.clen = index_input;
  rq.rparam = &resp;
  rq.rlen = sizeof(resp);
  if ( hci_send_req(&rq, FALSE) < 0 )
    return BLE_STATUS_TIMEOUT;
  if ( resp.Status )
    return resp.Status;
  *Service_Handle = resp.Service_Handle;
  return BLE_STATUS_SUCCESS;
}

[Guillaume K]

I don't see an issue.

Why do you say that

    Osal_MemCpy( (void*)&cp0->Service_UUID, (const void*)Service_UUID, size );

copies 2 BYTES from the short UUID , and 14 BYTES from the long UUID ?

Could you explain more ?

[DS.4]

Just the way Service_UUID is defined.

/* Definition of Service_UUID_t */
typedef PACKED(union)
{
  /**
   * 16-bit UUID
   */
  uint16_t Service_UUID_16;
  /**
   * 128-bit UUID
   */
  uint8_t Service_UUID_128[16];
} Service_UUID_t;

Copying 'size', that can be either 2 or 16, But always from the start of the struct...

[Guillaume K]

it's a C union. both members of Service_UUID_t are in fact at the same memory location.