From 00e6211ff8fa6849b8cd47c190b7aa6d37ca7c7e Mon Sep 17 00:00:00 2001 From: Zhang Hai Peng Date: Tue, 30 Dec 2025 11:53:41 +0800 Subject: [PATCH] fix(ble/bluedroid): Fix integer underflow in gatt_process_read_by_type_rsp (cherry picked from commit 597fc6e5c1b4a0448ad3d43185d9d48624085a0c) Co-authored-by: zhanghaipeng --- components/bt/host/bluedroid/stack/gatt/gatt_cl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_cl.c b/components/bt/host/bluedroid/stack/gatt/gatt_cl.c index ddd089f4e0..1cc9aefb47 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_cl.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_cl.c @@ -800,6 +800,14 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 handle_len = 4; } + /* Check value_len is sufficient before subtraction to prevent underflow */ + if (value_len < handle_len) { + GATT_TRACE_ERROR("gatt_process_read_by_type_rsp: value_len(%d) < handle_len(%d), invalid response", + value_len, handle_len); + gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL); + return; + } + value_len -= handle_len; /* subtract the handle pairs bytes */ len -= 1;