From 44dabfb15d17526ec5cab31965cc3d593c8e98b2 Mon Sep 17 00:00:00 2001
From: Diff-fusion <felix@buchmann.ruhr>
Date: Sat, 23 Nov 2024 20:53:28 +0100
Subject: [PATCH] Cordio BLE: Dynamically calculate message length (#385)

The vendor specific HCI event can contain messages of arbitrary length,
thus the length of the message allocation must depend on the length of
the event.
---
 .../cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c b/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c
index 98a000fc743..c10eb997e7d 100644
--- a/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c
+++ b/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c
@@ -2754,6 +2754,7 @@ void hciEvtProcessMsg(uint8_t *pEvt)
   uint8_t   evt;
   uint8_t   subEvt;
   uint8_t   len;
+  uint8_t   extraMsgLen = 0;
   uint8_t   cbackEvt = 0;
   hciEvt_t  *pMsg;
   uint16_t  handle;
@@ -3013,6 +3014,7 @@ void hciEvtProcessMsg(uint8_t *pEvt)
 #endif
       hciEvtStats.numVendorSpecEvt++;
       cbackEvt = HCI_VENDOR_SPEC_CBACK_EVT;
+      extraMsgLen = len;
 
 #ifdef WSF_DETOKEN_TRACE
       if (WsfDetokenProcessHciEvent(len, pEvt))
@@ -3030,7 +3032,7 @@ void hciEvtProcessMsg(uint8_t *pEvt)
   if (cbackEvt != 0)
   {
     /* allocate temp buffer */
-    if ((pMsg = WsfBufAlloc(hciEvtCbackLen[cbackEvt])) != NULL)
+    if ((pMsg = WsfBufAlloc(hciEvtCbackLen[cbackEvt] + extraMsgLen)) != NULL)
     {
       /* initialize message header */
       pMsg->hdr.param = 0;