pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete

Browse Source
This commit is contained in:
Jin Cheng
2025-10-13 09:21:34 +08:00
parent 04219e5fd4
commit 514bcb41a2
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_devctl.c
+7 -1
View File
@@ -1203,7 +1203,7 @@ tBTM_STATUS BTM_DeleteStoredLinkKey(BD_ADDR bd_addr, tBTM_CMPL_CB *p_cb)
** Returns void
**
*******************************************************************************/
void btm_delete_stored_link_key_complete (UINT8 *p)
void btm_delete_stored_link_key_complete (UINT8 *p, UINT16 evt_len)
{
tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_stored_link_key_cmpl_cb;
tBTM_DELETE_STORED_LINK_KEY_COMPLETE result;
@@ -1215,10 +1215,16 @@ void btm_delete_stored_link_key_complete (UINT8 *p)
/* Set the call back event to indicate command complete */
result.event = BTM_CB_EVT_DELETE_STORED_LINK_KEYS;
if (evt_len < 3) {
BTM_TRACE_ERROR("Malformatted event packet, too short");
result.status = BTM_ERR_PROCESSING;
goto err_out;
}
/* Extract the result fields from the HCI event */
STREAM_TO_UINT8 (result.status, p);
STREAM_TO_UINT16 (result.num_keys, p);
err_out:
/* Call the call back and pass the result */
(*p_cb)(&result);
}