alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-09-20 00:36:01 -04:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fix(ble/bluedroid): Fixed memory out-of-bounds issue when parsing adv data

Browse Source
This commit is contained in:
zhanghaipeng 2024-08-16 17:21:19 +08:00
parent e026fd1f81
commit 31e68c9d36
14 changed files with 118 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
components/bt/host/bluedroid/api/esp_gap_ble_api.c
View File

@ -469,21 +469,33 @@ esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t
return ESP_OK;
}
uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *length)
uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_len, esp_ble_adv_data_type type, uint8_t *length)
{
if (length == NULL) {
return NULL;
}
if (((type < ESP_BLE_AD_TYPE_FLAG) || (type > ESP_BLE_AD_TYPE_128SERVICE_DATA)) &&
(type != ESP_BLE_AD_MANUFACTURER_SPECIFIC_TYPE)) {
LOG_ERROR("the eir type not define, type = %x\n", type);
*length = 0;
return NULL;
}
if (adv_data == NULL) {
LOG_ERROR("Invalid p_eir data.\n");
if (adv_data == NULL || adv_data_len == 0) {
LOG_ERROR("Invalid advertising data.\n");
*length = 0;
return NULL;
}
return (BTM_CheckAdvData( adv_data, type, length));
return (BTM_CheckAdvData( adv_data, adv_data_len, type, length));
}
uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *length)
{
return esp_ble_resolve_adv_data_by_type( adv_data, ESP_BLE_ADV_DATA_LEN_MAX + ESP_BLE_SCAN_RSP_DATA_LEN_MAX, (esp_ble_adv_data_type) type, length);
}
#if (BLE_42_FEATURE_SUPPORT == TRUE)
esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_len)
{

32
components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
View File

@ -1888,17 +1888,41 @@ esp_err_t esp_ble_gap_get_device_name(void);
*
*/
esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t * addr_type);
/**
* @brief This function is called to get ADV data for a specific type.
*
* @param[in] adv_data - pointer of ADV data which to be resolved
* @param[in] type - finding ADV data type
* @param[out] length - return the length of ADV data not including type
* @note This is the recommended function to use for resolving ADV data by type.
* It improves upon the deprecated `esp_ble_resolve_adv_data` function by
* including an additional parameter to specify the length of the ADV data,
* thereby offering better safety and reliability.
*
* @return pointer of ADV data
* @param[in] adv_data - pointer of ADV data which to be resolved
* @param[in] adv_data_len - the length of ADV data which to be resolved.
* @param[in] type - finding ADV data type
* @param[out] length - return the length of ADV data not including type
*
* @return pointer of ADV data
*
*/
uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_len, esp_ble_adv_data_type type, uint8_t *length);
/**
* @brief This function is called to get ADV data for a specific type.
*
* @note This function has been deprecated and will be removed in a future release.
* Please use `esp_ble_resolve_adv_data_by_type` instead, which provides
* better parameter validation and supports more accurate data resolution.
*
* @param[in] adv_data - pointer of ADV data which to be resolved
* @param[in] type - finding ADV data type
* @param[out] length - return the length of ADV data not including type
*
* @return pointer of ADV data
*
*/
uint8_t *esp_ble_resolve_adv_data(uint8_t *adv_data, uint8_t type, uint8_t *length);
#if (BLE_42_FEATURE_SUPPORT == TRUE)
/**
* @brief This function is called to set raw advertising data. User need to fill

18
components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
View File

@ -2101,7 +2101,7 @@ BOOLEAN BTM_BleGetCurrentAddress(BD_ADDR addr, uint8_t *addr_type)
** Returns pointer of ADV data
**
*******************************************************************************/
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT16 adv_data_len, UINT8 type, UINT8 *p_length)
{
UINT8 *p = p_adv;
UINT8 length;
@ -2110,7 +2110,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
STREAM_TO_UINT8(length, p);
while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
while ( length && (p - p_adv < adv_data_len)) {
STREAM_TO_UINT8(adv_type, p);
if ( adv_type == type ) {
@ -2123,7 +2123,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
/* Break loop if advertising data is in an incorrect format,
as it may lead to memory overflow */
if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
if (p >= p_adv + adv_data_len) {
break;
}
@ -3176,7 +3176,7 @@ UINT8 btm_ble_is_discoverable(BD_ADDR bda, UINT8 evt_type, UINT8 *p)
}
if (p_le_inq_cb->adv_len != 0) {
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache,
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len,
BTM_BLE_AD_TYPE_FLAG, &data_len)) != NULL) {
flag = * p_flag;
@ -3392,7 +3392,7 @@ BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type
p_i->inq_count = p_inq->inq_counter; /* Mark entry for current inquiry */
if (p_le_inq_cb->adv_len != 0) {
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, BTM_BLE_AD_TYPE_FLAG, &len)) != NULL) {
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len, BTM_BLE_AD_TYPE_FLAG, &len)) != NULL) {
p_cur->flag = * p_flag;
}
}
@ -3402,11 +3402,11 @@ BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type
* then try to convert the appearance value to a class of device value Bluedroid can use.
* Otherwise fall back to trying to infer if it is a HID device based on the service class.
*/
p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, BTM_BLE_AD_TYPE_APPEARANCE, &len);
p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len, BTM_BLE_AD_TYPE_APPEARANCE, &len);
if (p_uuid16 && len == 2) {
btm_ble_appearance_to_cod((UINT16)p_uuid16[0] | (p_uuid16[1] << 8), p_cur->dev_class);
} else {
if ((p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache,
if ((p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len,
BTM_BLE_AD_TYPE_16SRV_CMPL, &len)) != NULL) {
UINT8 i;
for (i = 0; i + 2 <= len; i = i + 2) {
@ -3493,10 +3493,10 @@ void btm_send_sel_conn_callback(BD_ADDR remote_bda, UINT8 evt_type, UINT8 *p_dat
/* get the device name if exist in ADV data */
if (data_len != 0) {
p_dev_name = BTM_CheckAdvData(p_data, BTM_BLE_AD_TYPE_NAME_CMPL, &len);
p_dev_name = BTM_CheckAdvData(p_data, data_len, BTM_BLE_AD_TYPE_NAME_CMPL, &len);
if (p_dev_name == NULL) {
p_dev_name = BTM_CheckAdvData(p_data, BTM_BLE_AD_TYPE_NAME_SHORT, &len);
p_dev_name = BTM_CheckAdvData(p_data, data_len, BTM_BLE_AD_TYPE_NAME_SHORT, &len);
}
if (p_dev_name) {

2
components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h
View File

@ -2112,7 +2112,7 @@ void BTM_BleReadControllerFeatures(tBTM_BLE_CTRL_FEATURES_CBACK *p_vsc_cback);
**
*******************************************************************************/
//extern
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length);
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT16 adv_data_len, UINT8 type, UINT8 *p_length);
/*******************************************************************************
**

5
examples/bluetooth/bluedroid/ble/ble_spp_client/main/spp_client_demo.c
View File

@ -247,7 +247,10 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
case ESP_GAP_SEARCH_INQ_RES_EVT:
esp_log_buffer_hex(GATTC_TAG, scan_result->scan_rst.bda, 6);
ESP_LOGI(GATTC_TAG, "Searched Adv Data Len %d, Scan Response Len %d", scan_result->scan_rst.adv_data_len, scan_result->scan_rst.scan_rsp_len);
adv_name = esp_ble_resolve_adv_data(scan_result->scan_rst.ble_adv, ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_result->scan_rst.ble_adv,
scan_result->scan_rst.adv_data_len + scan_result->scan_rst.scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
ESP_LOGI(GATTC_TAG, "Searched Device Name Len %d", adv_name_len);
esp_log_buffer_char(GATTC_TAG, adv_name, adv_name_len);
ESP_LOGI(GATTC_TAG, "\n");

6
examples/bluetooth/bluedroid/ble/ble_throughput/throughput_client/main/example_ble_client_throughput.c
View File

@ -388,8 +388,10 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
case ESP_GAP_SEARCH_INQ_RES_EVT:
esp_log_buffer_hex(GATTC_TAG, scan_result->scan_rst.bda, 6);
ESP_LOGI(GATTC_TAG, "searched Adv Data Len %d, Scan Response Len %d", scan_result->scan_rst.adv_data_len, scan_result->scan_rst.scan_rsp_len);
adv_name = esp_ble_resolve_adv_data(scan_result->scan_rst.ble_adv,
ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_result->scan_rst.ble_adv,
scan_result->scan_rst.adv_data_len + scan_result->scan_rst.scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
ESP_LOGI(GATTC_TAG, "searched Device Name Len %d", adv_name_len);
esp_log_buffer_char(GATTC_TAG, adv_name, adv_name_len);
ESP_LOGI(GATTC_TAG, "\n");

6
examples/bluetooth/bluedroid/ble/gatt_client/main/gattc_demo.c
View File

@ -339,8 +339,10 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
case ESP_GAP_SEARCH_INQ_RES_EVT:
esp_log_buffer_hex(GATTC_TAG, scan_result->scan_rst.bda, 6);
ESP_LOGI(GATTC_TAG, "searched Adv Data Len %d, Scan Response Len %d", scan_result->scan_rst.adv_data_len, scan_result->scan_rst.scan_rsp_len);
adv_name = esp_ble_resolve_adv_data(scan_result->scan_rst.ble_adv,
ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_result->scan_rst.ble_adv,
scan_result->scan_rst.adv_data_len + scan_result->scan_rst.scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
ESP_LOGI(GATTC_TAG, "searched Device Name Len %d", adv_name_len);
esp_log_buffer_char(GATTC_TAG, adv_name, adv_name_len);

6
examples/bluetooth/bluedroid/ble/gatt_security_client/main/example_ble_sec_gattc_demo.c
View File

@ -439,8 +439,10 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
case ESP_GAP_SEARCH_INQ_RES_EVT:
esp_log_buffer_hex(GATTC_TAG, scan_result->scan_rst.bda, 6);
ESP_LOGI(GATTC_TAG, "Searched Adv Data Len %d, Scan Response Len %d", scan_result->scan_rst.adv_data_len, scan_result->scan_rst.scan_rsp_len);
adv_name = esp_ble_resolve_adv_data(scan_result->scan_rst.ble_adv,
ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_result->scan_rst.ble_adv,
scan_result->scan_rst.adv_data_len + scan_result->scan_rst.scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
ESP_LOGI(GATTC_TAG, "Searched Device Name Len %d", adv_name_len);
esp_log_buffer_char(GATTC_TAG, adv_name, adv_name_len);
ESP_LOGI(GATTC_TAG, "\n");

6
examples/bluetooth/bluedroid/ble/gattc_multi_connect/main/gattc_multi_connect.c
View File

@ -769,8 +769,10 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
case ESP_GAP_SEARCH_INQ_RES_EVT:
esp_log_buffer_hex(GATTC_TAG, scan_result->scan_rst.bda, 6);
ESP_LOGI(GATTC_TAG, "Searched Adv Data Len %d, Scan Response Len %d", scan_result->scan_rst.adv_data_len, scan_result->scan_rst.scan_rsp_len);
adv_name = esp_ble_resolve_adv_data(scan_result->scan_rst.ble_adv,
ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_result->scan_rst.ble_adv,
scan_result->scan_rst.adv_data_len + scan_result->scan_rst.scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
ESP_LOGI(GATTC_TAG, "Searched Device Name Len %d", adv_name_len);
esp_log_buffer_char(GATTC_TAG, adv_name, adv_name_len);
ESP_LOGI(GATTC_TAG, "\n");

6
examples/bluetooth/bluedroid/ble_50/ble50_security_client/main/ble50_sec_gattc_demo.c
View File

@ -484,8 +484,10 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
} else {
ESP_LOGI(GATTC_TAG, "extend adv, adv type 0x%x data len %d", param->ext_adv_report.params.event_type, param->ext_adv_report.params.adv_data_len);
}
adv_name = esp_ble_resolve_adv_data(param->ext_adv_report.params.adv_data,
ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(param->ext_adv_report.params.adv_data,
param->ext_adv_report.params.adv_data_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
if (!connect && strlen(remote_device_name) == adv_name_len && strncmp((char *)adv_name, remote_device_name, adv_name_len) == 0) {
connect = true;
esp_ble_gap_stop_ext_scan();

5
examples/bluetooth/bluedroid/ble_50/peroidic_sync/main/periodic_sync_demo.c
View File

@ -108,7 +108,10 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param
case ESP_GAP_BLE_EXT_ADV_REPORT_EVT: {
uint8_t *adv_name = NULL;
uint8_t adv_name_len = 0;
adv_name = esp_ble_resolve_adv_data(param->ext_adv_report.params.adv_data, ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(param->ext_adv_report.params.adv_data,
param->ext_adv_report.params.adv_data_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
if ((adv_name != NULL) && (memcmp(adv_name, "ESP_MULTI_ADV_80MS", adv_name_len) == 0) && !periodic_sync) {
periodic_sync = true;
char adv_temp_name[30] = {'0'};

6
examples/bluetooth/bluedroid/coex/gattc_gatts_coex/main/gattc_gatts_coex.c
View File

@ -293,8 +293,10 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param
esp_ble_gap_cb_param_t *scan_result = (esp_ble_gap_cb_param_t *)param;
switch (scan_result->scan_rst.search_evt) {
case ESP_GAP_SEARCH_INQ_RES_EVT:
adv_name = esp_ble_resolve_adv_data(scan_result->scan_rst.ble_adv,
ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_result->scan_rst.ble_adv,
scan_result->scan_rst.adv_data_len + scan_result->scan_rst.scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
if (adv_name != NULL) {
if (strlen(remote_device_name) == adv_name_len && strncmp((char *)adv_name, remote_device_name, adv_name_len) == 0) {
if (connect == false) {

20
examples/bluetooth/esp_hid_device/main/esp_hid_gap.c
View File

@ -358,22 +358,34 @@ static void handle_ble_device_result(struct ble_scan_result_evt_param *scan_rst)
char name[64] = {0};
uint8_t uuid_len = 0;
uint8_t *uuid_d = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_16SRV_CMPL, &uuid_len);
uint8_t *uuid_d = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_16SRV_CMPL,
&uuid_len);
if (uuid_d != NULL && uuid_len) {
uuid = uuid_d[0] + (uuid_d[1] << 8);
}
uint8_t appearance_len = 0;
uint8_t *appearance_d = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_APPEARANCE, &appearance_len);
uint8_t *appearance_d = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_APPEARANCE,
&appearance_len);
if (appearance_d != NULL && appearance_len) {
appearance = appearance_d[0] + (appearance_d[1] << 8);
}
uint8_t adv_name_len = 0;
uint8_t *adv_name = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
uint8_t *adv_name = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
if (adv_name == NULL) {
adv_name = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_NAME_SHORT, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_SHORT,
&adv_name_len);
}
if (adv_name != NULL && adv_name_len) {

20
examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
View File

@ -405,22 +405,34 @@ static void handle_ble_device_result(struct ble_scan_result_evt_param *scan_rst)
char name[64] = {0};
uint8_t uuid_len = 0;
uint8_t *uuid_d = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_16SRV_CMPL, &uuid_len);
uint8_t *uuid_d = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_16SRV_CMPL,
&uuid_len);
if (uuid_d != NULL && uuid_len) {
uuid = uuid_d[0] + (uuid_d[1] << 8);
}
uint8_t appearance_len = 0;
uint8_t *appearance_d = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_APPEARANCE, &appearance_len);
uint8_t *appearance_d = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_APPEARANCE,
&appearance_len);
if (appearance_d != NULL && appearance_len) {
appearance = appearance_d[0] + (appearance_d[1] << 8);
}
uint8_t adv_name_len = 0;
uint8_t *adv_name = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
uint8_t *adv_name = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
if (adv_name == NULL) {
adv_name = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_NAME_SHORT, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_SHORT,
&adv_name_len);
}
if (adv_name != NULL && adv_name_len) {