mirror/btstack
1
0
Fork 0
mirror of https://github.com/bluekitchen/btstack.git synced 2025-04-25 09:02:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

mesh/pb_adv: add size checks for adv data

Browse Source
This commit is contained in:
Matthias Ringwald 2021-02-10 15:19:42 +01:00
parent b85ad95289
commit 205dc73857
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/mesh/pb_adv.c
View File

@ -290,6 +290,9 @@ static void pb_adv_handle_transaction_start(uint8_t transaction_nr, const uint8_
// new transaction? // new transaction?
if (transaction_nr != pb_adv_msg_in_transaction_nr){ if (transaction_nr != pb_adv_msg_in_transaction_nr){
// check len
if (size < 4) return;
// check len // check len
uint16_t msg_len = big_endian_read_16(pdu, 1); uint16_t msg_len = big_endian_read_16(pdu, 1);
if (msg_len > MESH_PB_ADV_MAX_PDU_SIZE){ if (msg_len > MESH_PB_ADV_MAX_PDU_SIZE){
@ -433,6 +436,8 @@ static void pb_adv_handler(uint8_t packet_type, uint16_t channel, uint8_t *packe
UNUSED(channel); UNUSED(channel);
if (packet_type != HCI_EVENT_PACKET) return; if (packet_type != HCI_EVENT_PACKET) return;
if (size < 3) return;
const uint8_t * data; const uint8_t * data;
uint8_t length; uint8_t length;
uint32_t link_id; uint32_t link_id;
@ -440,6 +445,9 @@ static void pb_adv_handler(uint8_t packet_type, uint16_t channel, uint8_t *packe
uint8_t generic_provisioning_control; uint8_t generic_provisioning_control;
switch(packet[0]){ switch(packet[0]){
case GAP_EVENT_ADVERTISING_REPORT: case GAP_EVENT_ADVERTISING_REPORT:
// check minimal size
if (size < (12 + 8)) return;
// data starts at offset 12 // data starts at offset 12
data = &packet[12]; data = &packet[12];
// PDB ADV PDU // PDB ADV PDU