Fix NSRangeException crash in GNCBLEGATTServer

PiperOrigin-RevId: 943785961

internal/platform/implementation/apple/Mediums/BLE/GNCBLEGATTServer.m

@@ -357,6 +357,10 @@ static const int kMaxAdvertisementLengthOnIOS = 23;
     [_peripheralManager respondToRequest:request withResult:CBATTErrorAttributeNotFound];
     return;
   }
+  if (request.offset > value.length) {
+    [_peripheralManager respondToRequest:request withResult:CBATTErrorInvalidOffset];
+    return;
+  }
   request.value =
       [value subdataWithRange:NSMakeRange(request.offset, value.length - request.offset)];
   [_peripheralManager respondToRequest:request withResult:CBATTErrorSuccess];

internal/platform/implementation/apple/Mediums/BLE/Tests/GNCFakePeripheralManager.h

@@ -47,6 +47,9 @@ NS_ASSUME_NONNULL_BEGIN
 /** Expectation fulfilled when peripheral responds to a request with an error. */
 @property(nonatomic, readonly) XCTestExpectation *respondToRequestErrorExpectation;
 
+/** The last response result. */
+@property(nonatomic, assign) CBATTError lastResponseResult;
+
 /** Expectation fulfilled when peripheral unpublishes an L2CAP channel. */
 @property(nonatomic, readonly) XCTestExpectation *unpublishExpectation;
 
@@ -117,6 +120,20 @@ NS_ASSUME_NONNULL_BEGIN
 - (void)simulatePeripheralManagerDidReceiveReadRequestForService:(CBUUID *)service
                                                   characteristic:(CBUUID *)characteristic;
 
+/**
+ * Simulates a read request event with an offset.
+ *
+ * Creates a fake read request with the given offset for the given service and characteristic UUIDs
+ * and calls the @c gnc_peripheralManager:didReceiveReadRequest: delegate method.
+ *
+ * @param service The service UUID of the characteristic to read from.
+ * @param characteristic The characteristic UUID to read from.
+ * @param offset The offset to read from.
+ */
+- (void)simulatePeripheralManagerDidReceiveReadRequestForService:(CBUUID *)service
+                                                  characteristic:(CBUUID *)characteristic
+                                                          offset:(NSUInteger)offset;
+
 @end
 
 NS_ASSUME_NONNULL_END

internal/platform/implementation/apple/Mediums/BLE/Tests/GNCFakePeripheralManager.m

@@ -37,6 +37,9 @@
 // Keep a strong reference to the service.
 @property(readwrite, nonatomic) CBService *service;
 
+// Change property to readwrite for tests.
+@property(readwrite, nonatomic) NSUInteger offset;
+
 - (instancetype)initWithService:(CBUUID *)service characteristic:(CBUUID *)characteristic;
 
 @end
@@ -115,6 +118,7 @@ static const uint16_t kPSM = 192;
 }
 
 - (void)respondToRequest:(CBATTRequest *)request withResult:(CBATTError)result {
+  self.lastResponseResult = result;
   if (result == CBATTErrorSuccess) {
     [_respondToRequestSuccessExpectation fulfill];
     return;
@@ -176,6 +180,15 @@ static const uint16_t kPSM = 192;
   [_peripheralDelegate gnc_peripheralManager:self didReceiveReadRequest:request];
 }
 
+- (void)simulatePeripheralManagerDidReceiveReadRequestForService:(CBUUID *)service
+                                                  characteristic:(CBUUID *)characteristic
+                                                          offset:(NSUInteger)offset {
+  CBATTRequest *request = [[CBATTRequest alloc] initWithService:service
+                                                 characteristic:characteristic];
+  request.offset = offset;
+  [_peripheralDelegate gnc_peripheralManager:self didReceiveReadRequest:request];
+}
+
 - (void)setDelegate:(id<CBPeripheralManagerDelegate>)delegate {
   self.peripheralDelegate = (id<GNCPeripheralManagerDelegate>)delegate;
 }