pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ble/bluedroid): Add length check in prepare write response

Browse Source 
(cherry picked from commit b03ff3cf218c3974b798a700cf1ede95641fe7af)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2025-12-03 11:54:22 +08:00
parent 1936ba80d7
commit 569854b55a
4 changed files with 30 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/gatt/gatt_cl.c
+6 -6
View File
@@ -66,7 +66,7 @@ static const UINT16 disc_type_to_uuid[GATT_DISC_MAX] = {
0 /* no type filtering for DISC_CHAR_DSCPT */
};
// Use for GATTC discover infomation print
// Use for GATTC discover information print
#define GATT_DISC_INFO(fmt, args...) {if (gatt_cb.auto_disc == FALSE) BT_PRINT_I("BT_GATT", fmt, ## args);}
/*******************************************************************************
@@ -604,7 +604,7 @@ void gatt_process_prep_write_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op
GATT_TRACE_DEBUG("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);
if (len < GATT_PREP_WRITE_RSP_MIN_LEN) {
if ((len < GATT_PREP_WRITE_RSP_MIN_LEN) || ((len - 4) > GATT_MAX_ATTR_LEN)) {
GATT_TRACE_ERROR("illegal prepare write response length, discard");
gatt_end_operation(p_clcb, GATT_INVALID_PDU, &value);
return;
@@ -701,7 +701,7 @@ void gatt_process_notification(tGATT_TCB *p_tcb, UINT8 op_code,
}
p_tcb->ind_count = 0;
/* should notify all registered client with the handle value notificaion/indication
/* should notify all registered client with the handle value notification/indication
Note: need to do the indication count and start timer first then do callback
*/
for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
@@ -800,7 +800,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
handle_len = 4;
}
value_len -= handle_len; /* substract the handle pairs bytes */
value_len -= handle_len; /* subtract the handle pairs bytes */
len -= 1;
while (len >= (handle_len + value_len)) {
@@ -887,7 +887,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
gatt_end_operation(p_clcb, GATT_SUCCESS, (void *)p);
}
return;
} else { /* discover characterisitic */
} else { /* discover characteristic */
STREAM_TO_UINT8 (record_value.dclr_value.char_prop, p);
STREAM_TO_UINT16(record_value.dclr_value.val_handle, p);
if (!GATT_HANDLE_IS_VALID(record_value.dclr_value.val_handle)) {
@@ -979,7 +979,7 @@ void gatt_process_read_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op_code,
if (len == (p_tcb->payload_size - 1) && /* full packet for read or read blob rsp */
len + offset < GATT_MAX_ATTR_LEN) {
GATT_TRACE_DEBUG("full pkt issue read blob for remianing bytes old offset=%d len=%d new offset=%d",
GATT_TRACE_DEBUG("full pkt issue read blob for remaining bytes old offset=%d len=%d new offset=%d",
offset, len, p_clcb->counter);
gatt_act_read(p_clcb, p_clcb->counter);
} else { /* end of request, send callback */
components/bt/host/bluedroid/stack/smp/include/smp_int.h
+4 -1
View File
@@ -197,7 +197,7 @@ enum {
};
typedef UINT8 tSMP_BR_STATE;
/* random and encrption activity state */
/* random and encryption activity state */
enum {
SMP_GEN_COMPARE = 1,
SMP_GEN_CONFIRM,
@@ -363,6 +363,9 @@ extern tSMP_CB *smp_cb_ptr;
/* Functions provided by att_main.c */
extern void smp_init (void);
/* SMP command sizes per spec - defined in smp_utils.c */
extern const UINT8 smp_cmd_size_per_spec[];
/* smp main */
extern void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data);
components/bt/host/bluedroid/stack/smp/smp_l2c.c
+19 -3
View File
@@ -156,15 +156,31 @@ static void smp_connect_callback (UINT16 channel, BD_ADDR bd_addr, BOOLEAN conne
static void smp_data_received(UINT16 channel, BD_ADDR bd_addr, BT_HDR *p_buf)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 *p = (UINT8 *)(p_buf + 1) + p_buf->offset;
UINT8 cmd ;
UINT8 *p;
UINT8 cmd;
SMP_TRACE_EVENT ("\nSMDBG l2c %s\n", __FUNCTION__);
/* Validate packet length before accessing data to prevent out-of-bounds read */
if (p_buf->len < 1) {
SMP_TRACE_WARNING ("Ignore empty SMP packet (len=%d)\n", p_buf->len);
osi_free (p_buf);
return;
}
p = (UINT8 *)(p_buf + 1) + p_buf->offset;
STREAM_TO_UINT8(cmd, p);
/* sanity check */
if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
SMP_TRACE_WARNING( "Ignore received command with RESERVED code 0x%02x\n", cmd);
SMP_TRACE_WARNING ("Ignore received command with RESERVED code 0x%02x\n", cmd);
osi_free (p_buf);
return;
}
/* Validate command length to prevent out-of-bounds read in handler functions */
if (p_buf->len != smp_cmd_size_per_spec[cmd]) {
SMP_TRACE_WARNING ("Ignore SMP cmd 0x%02x with invalid length %d (expected %d)\n",
cmd, p_buf->len, smp_cmd_size_per_spec[cmd]);
osi_free (p_buf);
return;
}
components/bt/host/bluedroid/stack/smp/smp_utils.c
+1 -1
View File
@@ -55,7 +55,7 @@
#define SMP_PAIR_KEYPR_NOTIF_SIZE (1 /* opcode */ + 1 /*Notif Type*/)
/* SMP command sizes per spec */
static const UINT8 smp_cmd_size_per_spec[] = {
const UINT8 smp_cmd_size_per_spec[] = {
0,
SMP_PAIRING_REQ_SIZE, /* 0x01: pairing request */
SMP_PAIRING_REQ_SIZE, /* 0x02: pairing response */