BLEclient readValue() crash

[qrpfun]

The problem was present before last library files update and I just commented out those lines (you can see in the very first code submitted in issue #786 where was commented out)

Here are related lines from BLEClient example:

    ....
    Serial.println(" - Found our characteristic");
    Serial.print("5-BLE FreeHeap: ");
    Serial.println(ESP.getFreeHeap());
    // BIG CRASH HERE - Read the value of the characteristic.
    if(pRemoteCharacteristic->canRead()) {
      std::string value = pRemoteCharacteristic->readValue(); // <== HERE HEAP CRASH
      Serial.print("The characteristic value was: ");
      Serial.println(value.c_str());
    }
    if(pRemoteCharacteristic->canNotify())
      pRemoteCharacteristic->registerForNotify(notifyCallback);
    connected = true;

And here the other related heap crash that happens just while reading characteristic with all debug active (in my Arduino 1.8.7 I do not see the backtrace encode)

[D][BLEClient.cpp:455] getServices(): << getServices
[D][BLEClient.cpp:415] getService(): << getService: found the service with uuid: 0000ffe0-0000-1000-8000-00805f9b34fb
[D][BLERemoteService.cpp:122] retrieveCharacteristics(): >> retrieveCharacteristics() for service: 0000ffe0-0000-1000-8000-00805f9b34fb
[D][BLERemoteService.cpp:153] retrieveCharacteristics(): Found a characteristic: Handle: 54, UUID: 0000ffe1-0000-1000-8000-00805f9b34fb
[D][BLERemoteCharacteristic.cpp:43] BLERemoteCharacteristic(): >> BLERemoteCharacteristic: handle: 54 0x54, uuid: 0000ffe1-0000-1000-8000-00805f9b34fb
[D][BLERemoteCharacteristic.cpp:256] retrieveDescriptors(): >> retrieveDescriptors() for characteristic: 0000ffe1-0000-1000-8000-00805f9b34fb
[D][BLERemoteCharacteristic.cpp:286] retrieveDescriptors(): Found a descriptor: Handle: 55, UUID: 00002902-0000-1000-8000-00805f9b34fb
[D][BLERemoteCharacteristic.cpp:286] retrieveDescriptors(): Found a descriptor: Handle: 56, UUID: 00002901-0000-1000-8000-00805f9b34fb
[D][BLERemoteCharacteristic.cpp:300] retrieveDescriptors(): << retrieveDescriptors(): Found 2 descriptors.
[D][BLERemoteCharacteristic.cpp:51] BLERemoteCharacteristic(): << BLERemoteCharacteristic
[D][BLERemoteService.cpp:169] retrieveCharacteristics(): << retrieveCharacteristics()
 - Found our characteristic
5-BLE FreeHeap: 170748
[D][BLERemoteCharacteristic.cpp:404] readValue(): >> readValue(): uuid: 0000ffe1-0000-1000-8000-00805f9b34fb, handle: 54 0x36
[D][FreeRTOS.cpp:164] take(): Semaphore taking: name: ReadCharEvt (0x3ffe2188), owner: <N/A> for readValue
[D][FreeRTOS.cpp:173] take(): Semaphore taken:  name: ReadCharEvt (0x3ffe2188), owner: readValue
[V][FreeRTOS.cpp:69] wait(): >> wait: Semaphore waiting: name: ReadCharEvt (0x3ffe2188), owner: readValue for readValue
[D][BLEDevice.cpp:152] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... ESP_GATTC_READ_CHAR_EVT
[V][BLEUtils.cpp:1270] dumpGattClientEvent(): GATT Event: ESP_GATTC_READ_CHAR_EVT
[D][BLEClient.cpp:168] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... ESP_GATTC_READ_CHAR_EVT
assertion "heap != NULL && "free() target pointer is outside heap areas"" failed: file "/Users/ficeto/Desktop/ESP32/ESP32/esp-idf-public/components/heap/heap_caps.c", line 268, function: heap_caps_free
abort() was called at PC 0x4014d073 on core 0

Backtrace: 0x4008d908:0x3ffcf940 0x4008db39:0x3ffcf960 0x4014d073:0x3ffcf980 0x400846ab:0x3ffcf9b0 0x4008a3e5:0x3ffcf9d0 0x4000bec7:0x3ffcf9f0 0x400d5f76:0x3ffcfa10 0x400d6e2d:0x3ffcfa50 0x400d4c5d:0x3ffcfa70 0x400d59c1:0x3ffcfb20 0x400e6325:0x3ffcfb90 0x400e2316:0x3ffcfbe0 0x4009257d:0x3ffcfc10

Rebooting...
ets Jun  8 2016 00:22:57

[sabsik]

I still experience this type of crash when tying to read value of the data characteristic (handle 0x35) of "Flower care" device on ESP32. Some other characteristics can be read without crash, but this is the needed one. Note that the characteristic is a 16-byte binary value (with lots of zeros inside), but I tried to read it as string, because there is no better alternative in BLERemoteCharacteristic class. Attempts to read using readUInt32(), etc. crash the same way. I see this issue is closed, but was there any positive resolution? Thanks.

[sabsik]

The fix was simple - initialize member variable m_rawData to nullptr in the constructor of BLERemoteCharacteristic (file BLERemoteCharacteristic.cpp, line 35):

...
31 BLERemoteCharacteristic::BLERemoteCharacteristic(
32 		uint16_t             handle,
33 		BLEUUID              uuid,
34 		esp_gatt_char_prop_t charProp,
35 		BLERemoteService*    pRemoteService) : m_rawData(nullptr), m_rawDataLen(0) {
36	log_v(">> BLERemoteCharacteristic: handle: %d 0x%d, uuid: %s", handle, handle, uuid.toString().c_str());
...

I also suggest adding another member m_rawDataLen to be able to query length of the raw data and appropriate member function that returns it. It is a little bit inconsistent that string (at least) needs to be read to get raw data, but it is OK for now.