alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

ble_mesh: stack: Fix invalid provisioning pdu type check

Browse Source 
For case MESH/NODE/PROV/BI-15-C
This commit is contained in:
wangjialiang 2021-03-04 16:06:24 +08:00
parent 83b1dd1c11
commit b4650fcc16
1 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
components/bt/esp_ble_mesh/mesh_core/prov.c
View File

@ -1450,18 +1450,22 @@ static void prov_msg_recv(void)
return;
}
if (type != PROV_FAILED && type != link.expect) {
BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
return;
}
/* For case MESH/NODE/PROV/BI-15-C, when the node receive a Provisioning PDU
* with the Type field set to the lowest unsupported or RFU value, it sends a
* Provisioning Failed PDU with the Error Code field set to Invalid PDU(0x01).
*/
if (type >= ARRAY_SIZE(prov_handlers)) {
BT_ERR("Unknown provisioning PDU type 0x%02x", type);
prov_send_fail_msg(PROV_ERR_NVAL_PDU);
return;
}
if (type != PROV_FAILED && type != link.expect) {
BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
return;
}
if (1 + prov_handlers[type].len != link.rx.buf->len) {
BT_ERR("Invalid length %u for type 0x%02x",
link.rx.buf->len, type);
@ -1666,15 +1670,20 @@ int bt_mesh_pb_gatt_recv(struct bt_mesh_conn *conn, struct net_buf_simple *buf)
return -EINVAL;
}
/* For case MESH/NODE/PROV/BI-15-C, when the node receive a Provisioning PDU
* with the Type field set to the lowest unsupported or RFU value, it sends a
* Provisioning Failed PDU with the Error Code field set to Invalid PDU(0x01).
*/
type = net_buf_simple_pull_u8(buf);
if (type != PROV_FAILED && type != link.expect) {
BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
if (type >= ARRAY_SIZE(prov_handlers)) {
BT_ERR("Unknown provisioning PDU type 0x%02x", type);
prov_send_fail_msg(PROV_ERR_NVAL_PDU);
return -EINVAL;
}
if (type >= ARRAY_SIZE(prov_handlers)) {
BT_ERR("Unknown provisioning PDU type 0x%02x", type);
if (type != PROV_FAILED && type != link.expect) {
BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
return -EINVAL;
}