pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bt): fix BLE security issue in controller and HCI packet parser

Browse Source 
(cherry picked from commit a721e94a0fc78c61f6690126a982ac2966ff400b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2025-12-30 11:53:40 +08:00
committed by BOT
parent 9ad2dd11ad
commit a805e4e6e8
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/device/controller.c
+1 -1
View File
@@ -87,7 +87,7 @@ typedef struct {
uint16_t ble_ext_adv_data_max_len;
#endif // #if (BLE_50_EXTEND_ADV_EN == TRUE)
#if (BLE_50_EXTEND_SYNC_EN == TRUE)
uint16_t get_ble_periodic_advertiser_list_size;
uint8_t get_ble_periodic_advertiser_list_size;
#endif // #if (BLE_50_EXTEND_SYNC_EN == TRUE)
#endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
} controller_local_param_t;
components/bt/host/bluedroid/hci/hci_packet_parser.c
+3 -3
View File
@@ -219,7 +219,7 @@ static void parse_ble_read_suggested_default_data_length_response(
uint16_t *ble_default_packet_txtime_ptr)
{
uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 4 /* bytes after: 2+2 */);
if (stream) {
STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
@@ -235,7 +235,7 @@ static void parse_ble_read_adv_max_len_response(
uint16_t *adv_max_len_ptr)
{
uint8_t *stream = read_command_complete_header(response, HCI_BLE_RD_MAX_ADV_DATA_LEN, 1 /* bytes after */);
uint8_t *stream = read_command_complete_header(response, HCI_BLE_RD_MAX_ADV_DATA_LEN, 2 /* bytes after */);
if (stream) {
// Size: 2 Octets ; Value: 0x001F – 0x0672 ; Maximum supported advertising data length
STREAM_TO_UINT16(*adv_max_len_ptr, stream);
@@ -246,7 +246,7 @@ static void parse_ble_read_adv_max_len_response(
#if (BLE_50_EXTEND_SYNC_EN == TRUE)
static void parse_ble_read_periodic_adv_list_size_response(
BT_HDR *response,
uint16_t *periodic_adv_list_size_ptr)
uint8_t *periodic_adv_list_size_ptr)
{
uint8_t *stream = read_command_complete_header(response, HCI_BLE_RD_PERIOD_ADV_LIST_SIZE, 1 /* bytes after */);
components/bt/host/bluedroid/hci/include/hci/hci_packet_parser.h
+1 -1
View File
@@ -114,7 +114,7 @@ typedef struct {
#if (BLE_50_EXTEND_SYNC_EN == TRUE)
void (*parse_ble_read_periodic_adv_list_size_response) (
BT_HDR *response,
uint16_t *periodic_advertiser_list_size
uint8_t *periodic_advertiser_list_size
);
#endif // #if (BLE_50_EXTEND_SYNC_EN == TRUE)
#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)