HeapCrash / Challenges / BLE characteristic write handler

BLE characteristic write handler

A BLE peripheral exposes a device-name characteristic and a 4-byte config characteristic. The stack calls this handler for every write from a phone. A fuzzing app crashed it in minutes, and testers report the link dropping when they save settings.

The code

Embedded C for Cortex-M. It compiles. There are 4 real bugs in it: the kind that pass a bench test and fail in the field.

typedef struct {
    uint16_t interval_ms;
    uint8_t  tx_power;
    uint8_t  flags;
} cfg_t;

static char  dev_name[20];
static cfg_t cfg;

int on_gatt_write(uint16_t handle, const uint8_t *data, uint16_t len)
{
    switch (handle) {
    case HANDLE_NAME:
        memcpy(dev_name, data, len);
        dev_name[len] = '\0';
        break;
    case HANDLE_CONFIG:
        cfg = *(const cfg_t *)data;
        flash_save_cfg(&cfg);
        break;
    }
    return 0;
}

What an interviewer expects

The bugs, reference fixes and the follow-up question are in the practice app, after you've tried it.

Companies that test this

Matched on the skills each company's embedded roles emphasise.

Related challenges

Flag the lines, say what breaks, then fix it and build it with clang in your browser.

Find the bugs