alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'bugfix/ble_check_adv_data_v5.1' into 'release/v5.1'

Browse Source 
fix(bt/bluedroid): Fix ble adv data check to avoid memory overflow（backport v5.1）

See merge request espressif/esp-idf!28406
This commit is contained in:
Island 2024-01-25 12:06:02 +08:00
commit e4ae078224
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
View File

@ -2090,7 +2090,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
STREAM_TO_UINT8(length, p);
while ( length && (p - p_adv <= BTM_BLE_CACHE_ADV_DATA_MAX)) {
while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
STREAM_TO_UINT8(adv_type, p);
if ( adv_type == type ) {
@ -2098,7 +2098,15 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
*p_length = length - 1; /* minus the length of type */
return p;
}
p += length - 1; /* skip the length of data */
/* Break loop if advertising data is in an incorrect format,
as it may lead to memory overflow */
if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
break;
}
STREAM_TO_UINT8(length, p);
}