fix(ble/bluedroid): Fix integer underflow in gatt_process_read_by_type_rsp

(cherry picked from commit 597fc6e5c1b4a0448ad3d43185d9d48624085a0c) Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2025-12-30 11:53:41 +08:00
parent a805e4e6e8
commit 00e6211ff8
1 changed files with 8 additions and 0 deletions
@@ -800,6 +800,14 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
        handle_len = 4;
    }

+    /* Check value_len is sufficient before subtraction to prevent underflow */
+    if (value_len < handle_len) {
+        GATT_TRACE_ERROR("gatt_process_read_by_type_rsp: value_len(%d) < handle_len(%d), invalid response",
+                         value_len, handle_len);
+        gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
+        return;
+    }
+
    value_len -= handle_len; /* subtract the handle pairs bytes */
    len -= 1;