alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-09-20 10:46:02 -04:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'bugfix/fix_blufi_frag_pkt_vulnerability' into 'master'

Browse Source 
Fixed vulnerability attacks that could cause heap overflow in fragmented Blufi packet processing

Closes BT-3106

See merge request espressif/esp-idf!21819
This commit is contained in:
Zhi Wei Jian 2023-01-10 21:13:01 +08:00
commit c176e5e0ec
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
components/bt/common/api/include/api/esp_blufi_api.h
View File

@ -78,6 +78,7 @@ typedef enum {
ESP_BLUFI_DATA_FORMAT_ERROR,
ESP_BLUFI_CALC_MD5_ERROR,
ESP_BLUFI_WIFI_SCAN_FAIL,
ESP_BLUFI_MSG_STATE_ERROR,
} esp_blufi_error_state_t;
/**

22
components/bt/common/btc/profile/esp/blufi/blufi_prf.c
View File

@ -136,6 +136,16 @@ void btc_blufi_recv_handler(uint8_t *data, int len)
if (BLUFI_FC_IS_FRAG(hdr->fc)) {
if (blufi_env.offset == 0) {
/*
blufi_env.aggr_buf should be NULL if blufi_env.offset is 0.
It is possible that the process of sending fragment packet
has not been completed
*/
if (blufi_env.aggr_buf) {
BTC_TRACE_ERROR("%s msg error, blufi_env.aggr_buf is not freed\n", __func__);
btc_blufi_report_error(ESP_BLUFI_MSG_STATE_ERROR);
return;
}
blufi_env.total_len = hdr->data[0] | (((uint16_t) hdr->data[1]) << 8);
blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
if (blufi_env.aggr_buf == NULL) {
@ -155,6 +165,18 @@ void btc_blufi_recv_handler(uint8_t *data, int len)
} else {
if (blufi_env.offset > 0) { /* if previous pkt is frag */
/* blufi_env.aggr_buf should not be NULL */
if (blufi_env.aggr_buf == NULL) {
BTC_TRACE_ERROR("%s buffer is NULL\n", __func__);
btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
return;
}
/* payload length should be equal to total_len */
if ((blufi_env.offset + hdr->data_len) != blufi_env.total_len) {
BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
return;
}
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);
btc_blufi_protocol_handler(hdr->type, blufi_env.aggr_buf, blufi_env.total_len);