From e8b7c6f70c27b73452fdbfb499500959f0f0256d Mon Sep 17 00:00:00 2001
From: wangfq <wangfq@collectpublish.net>
Date: Wed, 12 Aug 2026 14:51:21 +0800
Subject: [PATCH] =?UTF-8?q?fix(vd960DBN):=20BLE=20=E5=93=8D=E5=BA=94?=
 =?UTF-8?q?=E7=BC=93=E5=86=B2=E8=B6=8A=E7=95=8C=E9=98=B2=E5=BE=A1=20?=
 =?UTF-8?q?=E2=80=94=20=E6=A0=B9=E5=9B=A0:=20MAX=5FBLE=5FDAT=5FBUF=5FLEN?=
 =?UTF-8?q?=20=E5=AE=8F=E4=B8=8D=E4=B8=80=E8=87=B4(ODR)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

根因链 (14:46 日志 + .map 铁证):
- .map: g_buf_ble_response = 107B (7 + dat[100]) -> 编译时 MAX_BLE_DAT_BUF_LEN=100
- 但 QUERY 响应 130B 写入 dat[0..129] -> 越界 30B
- 越界踩中相邻 g_notify_buftemp.flag/len (0x20007BDC)
- 第二分包填充后被物理抹除 (无 CLR_NTF = 非 clear_ble_notify_buf 干的)

修复 (兼容新旧宏, 永不越界):
- QUERY: _req_count 按 MAX_BLE_TMP_BUF_LEN 动态限制 (100->3条/132->4条)
- set_response_buf: dat_len 截断到 MAX_BLE_DAT_BUF_LEN
- 验证: 旧宏100 下 3条=98B 分包[93,17] 全合规
---
 vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c
index fa73d31..e28961d 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c
@@ -284,6 +284,7 @@ uint8_t set_response_buf(Buf_DBN_BLE *response_dst, uint8_t magic, uint8_t cmd,
 {
     uint8_t ret = 0;
     uint8_t i = 0;
+    if(dat_len > MAX_BLE_DAT_BUF_LEN) dat_len = MAX_BLE_DAT_BUF_LEN;  /* overflow guard */
     clear_buf_dbn_ble(response_dst);
     response_dst->magic = magic;
     response_dst->cmd = cmd;
@@ -979,6 +980,12 @@ void manage_dbn_ble_default(uint8_t *pkg, uint8_t len)
             _req_count = pkg[8];
             if (_req_count > OFFLOG_MAX_QUERY_RECORDS) _req_count = OFFLOG_MAX_QUERY_RECORDS;
             if (_req_count == 0) _req_count = OFFLOG_MAX_QUERY_RECORDS;
+            /* overflow guard: resp dat = 2 + N*32 must fit tmp buf.
+               history: MAX_BLE_TMP_BUF_LEN was 100, 130B write overflowed
+               into g_notify_buftemp and erased pending chunk 2 */
+            { uint16_t _max_rec = (MAX_BLE_TMP_BUF_LEN >= 2) ?
+                ((MAX_BLE_TMP_BUF_LEN - 2) / (uint16_t)sizeof(OfflogEvt)) : 0;
+              if (_req_count > _max_rec) _req_count = _max_rec; }
 
             tmp_ble_buf[_i++] = 0x00;    /* status ok */
             tmp_ble_buf[_i++] = 0;       /* count placeholder */