pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ble/bluedroid): Add length check in prepare write response

Browse Source 
(cherry picked from commit b03ff3cf218c3974b798a700cf1ede95641fe7af)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2025-12-03 11:54:22 +08:00
parent 1936ba80d7
commit 569854b55a
4 changed files with 30 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/smp/include/smp_int.h
+4 -1
View File
@@ -197,7 +197,7 @@ enum {
};
typedef UINT8 tSMP_BR_STATE;
/* random and encrption activity state */
/* random and encryption activity state */
enum {
SMP_GEN_COMPARE = 1,
SMP_GEN_CONFIRM,
@@ -363,6 +363,9 @@ extern tSMP_CB *smp_cb_ptr;
/* Functions provided by att_main.c */
extern void smp_init (void);
/* SMP command sizes per spec - defined in smp_utils.c */
extern const UINT8 smp_cmd_size_per_spec[];
/* smp main */
extern void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data);
components/bt/host/bluedroid/stack/smp/smp_l2c.c
+19 -3
View File
@@ -156,15 +156,31 @@ static void smp_connect_callback (UINT16 channel, BD_ADDR bd_addr, BOOLEAN conne
static void smp_data_received(UINT16 channel, BD_ADDR bd_addr, BT_HDR *p_buf)
{
tSMP_CB *p_cb = &smp_cb;
UINT8 *p = (UINT8 *)(p_buf + 1) + p_buf->offset;
UINT8 cmd ;
UINT8 *p;
UINT8 cmd;
SMP_TRACE_EVENT ("\nSMDBG l2c %s\n", __FUNCTION__);
/* Validate packet length before accessing data to prevent out-of-bounds read */
if (p_buf->len < 1) {
SMP_TRACE_WARNING ("Ignore empty SMP packet (len=%d)\n", p_buf->len);
osi_free (p_buf);
return;
}
p = (UINT8 *)(p_buf + 1) + p_buf->offset;
STREAM_TO_UINT8(cmd, p);
/* sanity check */
if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
SMP_TRACE_WARNING( "Ignore received command with RESERVED code 0x%02x\n", cmd);
SMP_TRACE_WARNING ("Ignore received command with RESERVED code 0x%02x\n", cmd);
osi_free (p_buf);
return;
}
/* Validate command length to prevent out-of-bounds read in handler functions */
if (p_buf->len != smp_cmd_size_per_spec[cmd]) {
SMP_TRACE_WARNING ("Ignore SMP cmd 0x%02x with invalid length %d (expected %d)\n",
cmd, p_buf->len, smp_cmd_size_per_spec[cmd]);
osi_free (p_buf);
return;
}
components/bt/host/bluedroid/stack/smp/smp_utils.c
+1 -1
View File
@@ -55,7 +55,7 @@
#define SMP_PAIR_KEYPR_NOTIF_SIZE (1 /* opcode */ + 1 /*Notif Type*/)
/* SMP command sizes per spec */
static const UINT8 smp_cmd_size_per_spec[] = {
const UINT8 smp_cmd_size_per_spec[] = {
0,
SMP_PAIRING_REQ_SIZE, /* 0x01: pairing request */
SMP_PAIRING_REQ_SIZE, /* 0x02: pairing response */