[Coverity CID :218728] Out-of-bounds access in subsys/bluetooth/host/gatt.c

[zephyrbot]

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/fe7c2efca800a0cf1bccf23aefe08b3c4beb88bf/subsys/bluetooth/host/gatt.c#L1303

Category: Memory - corruptions
Function: get_service_handles
Component: Bluetooth
CID: 218728

Details:

1297     static uint8_t get_service_handles(const struct bt_gatt_attr *attr,
1298                        uint16_t handle, void *user_data)
1299     {
1300         struct gatt_incl *include = user_data;
1301    
1302         /* Stop if attribute is a service */
>>>     CID 218728:    (OVERRUN)
>>>     Overrunning array "struct bt_uuid_16 [1]({{.uuid = {BT_UUID_TYPE_16}, .val = 10241}})" of 4 bytes by passing it to a function which accesses it at byte offset 16.
1303         if (!bt_uuid_cmp(attr->uuid, BT_UUID_GATT_PRIMARY) ||
1304             !bt_uuid_cmp(attr->uuid, BT_UUID_GATT_SECONDARY)) {
1305             return BT_GATT_ITER_STOP;
1306         }
1307    
1308         include->end_handle = handle;
1297     static uint8_t get_service_handles(const struct bt_gatt_attr *attr,
1298                        uint16_t handle, void *user_data)
1299     {
1300         struct gatt_incl *include = user_data;
1301    
1302         /* Stop if attribute is a service */
>>>     CID 218728:    (OVERRUN)
>>>     Overrunning array "struct bt_uuid_16 [1]({{.uuid = {BT_UUID_TYPE_16}, .val = 10240}})" of 4 bytes by passing it to a function which accesses it at byte offset 16.
1303         if (!bt_uuid_cmp(attr->uuid, BT_UUID_GATT_PRIMARY) ||
1304             !bt_uuid_cmp(attr->uuid, BT_UUID_GATT_SECONDARY)) {
1305             return BT_GATT_ITER_STOP;
1306         }
1307    
1308         include->end_handle = handle;

Please fix or provide comments in coverity using the link:

https://scan9.coverity.com/reports.htm#v32951/p12996.

Note: This issue was created automatically. Priority was set based on classification
of the file affected and the impact field in coverity. Assignees were set using the CODEOWNERS file.

[joerchan]

Passing bt_uuid_16 with type BT_UUID_TYPE_16 will not take case branch BT_UUID_TYPE_128 in uuid_to_uuid128