Bluetooth: gatt: Fix potential NULL pointer dereference

If the device was not paired, the conn->le.keys is NULL, so conn->le.keys will cause NULL pointer dereference. Signed-off-by: Mariusz Skamra <[email protected]>
andak · Jul 25, 2022 · 6d85bd5 · 6d85bd5
1 parent 2245bf8
commit 6d85bd5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/subsys/bluetooth/host/gatt.c b/subsys/bluetooth/host/gatt.c
@@ -2877,7 +2877,7 @@ uint8_t bt_gatt_check_perm(struct bt_conn *conn, const struct bt_gatt_attr *attr
 	mask &= attr->perm;
 
 	if (mask & BT_GATT_PERM_LESC_MASK) {
-		if (!IS_ENABLED(CONFIG_BT_SMP) ||
+		if (!IS_ENABLED(CONFIG_BT_SMP) || !conn->le.keys ||
 		    (conn->le.keys->flags & BT_KEYS_SC) == 0) {
 			return BT_ATT_ERR_AUTHENTICATION;
 		}