Hello.
It is possible to overwrite the contents of the memory using a 32-character string permitted by the standard for
mf_name
and model_id
fields from zb_zcl_basic_attrs_ext_t
struct located in /external/zboss/addons/zcl/zb_zcl_basic_addons.h
header file of Zigbee SDK 4.0.0/** @brief Basic cluster attributes according to ZCL Spec 3.2.2.2 */ typedef struct { zb_uint8_t zcl_version; zb_uint8_t app_version; zb_uint8_t stack_version; zb_uint8_t hw_version; zb_char_t mf_name[32]; zb_char_t model_id[32]; zb_char_t date_code[16]; zb_uint8_t power_source; zb_char_t location_id[15]; zb_uint8_t ph_env; zb_char_t sw_ver[17]; } zb_zcl_basic_attrs_ext_t;
It is required to allocate 1 byte more in memory than necessary to place the information about the length of the character string in the first byte.
An example of writing 32-char string "0123456789abcdef0123456789abcdef" using
ZB_ZCL_SET_STRING_VAL
macro:
Also, the size of the
location_id
field should be sufficient to store a character string 16 bytes long (3.2.2.2.16, ZCL 7), but its length is defined as 15 (should be 17 to store 1-byte string length and 16-byte string data)