mirror/btstack
1
0
Fork 0
mirror of https://github.com/bluekitchen/btstack.git synced 2025-03-29 22:20:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

l2cap: check cmd len before reading dest_cid in classic signaling handler

Browse Source
This commit is contained in:
Matthias Ringwald 2023-12-12 17:21:52 +01:00
parent 1f0786fdf5
commit 977cd8e3de
1 changed files with 31 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
src/l2cap.c
View File

@ -3747,26 +3747,28 @@ static void l2cap_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t *
break; break;
} }
// Get potential destination CID if (cmd_len >= 2){
uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET); // Get potential destination CID
uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
// Find channel for this sig_id and connection handle
btstack_linked_list_iterator_init(&it, &l2cap_channels); // Find channel for this sig_id and connection handle
while (btstack_linked_list_iterator_has_next(&it)){ btstack_linked_list_iterator_init(&it, &l2cap_channels);
l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it); while (btstack_linked_list_iterator_has_next(&it)){
if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue; l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
if (channel->con_handle != handle) continue; if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
if (code & 1) { if (channel->con_handle != handle) continue;
// match odd commands (responses) by previous signaling identifier if (code & 1) {
if (channel->local_sig_id == sig_id) { // match odd commands (responses) by previous signaling identifier
l2cap_signaling_handler_channel(channel, command); if (channel->local_sig_id == sig_id) {
return; l2cap_signaling_handler_channel(channel, command);
} return;
} else { }
// match even commands (requests) by local channel id } else {
if (channel->local_cid == dest_cid) { // match even commands (requests) by local channel id
l2cap_signaling_handler_channel(channel, command); if (channel->local_cid == dest_cid) {
return; l2cap_signaling_handler_channel(channel, command);
return;
}
} }
} }
} }
@ -3778,16 +3780,20 @@ static void l2cap_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t *
case CONFIGURE_RESPONSE: case CONFIGURE_RESPONSE:
case DISCONNECTION_RESPONSE: case DISCONNECTION_RESPONSE:
// Ignore request // Ignore request
break; return;
case CONFIGURE_REQUEST: case CONFIGURE_REQUEST:
// send command reject with reason invalid cid if (cmd_len >= 2){
l2cap_register_signaling_response(handle, CONFIGURE_REQUEST, sig_id, dest_cid, L2CAP_REJ_INVALID_CID); uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
// send command reject with reason invalid cid
l2cap_register_signaling_response(handle, CONFIGURE_REQUEST, sig_id, dest_cid, L2CAP_REJ_INVALID_CID);
return;
}
break; break;
default: default:
// send command reject with reason unknown command
l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
break; break;
} }
// otherwise send command reject with reason unknown command
l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
} }
#endif #endif