mirror/btstack
1
0
Fork 0
mirror of https://github.com/bluekitchen/btstack.git synced 2025-01-28 00:35:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

mesh: validate size of pb-adv pdus

Browse Source
This commit is contained in:
Matthias Ringwald 2019-07-19 18:19:42 +02:00
parent 19974f17e1
commit f843ee5dd2
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/mesh/pb_adv.c
View File

@ -156,6 +156,9 @@ static void pb_adv_emit_link_close(uint16_t pb_transport_cid, uint8_t reason){
} }
static void pb_adv_handle_bearer_control(uint32_t link_id, uint8_t transaction_nr, const uint8_t * pdu, uint16_t size){ static void pb_adv_handle_bearer_control(uint32_t link_id, uint8_t transaction_nr, const uint8_t * pdu, uint16_t size){
UNUSED(transaction_nr);
UNUSED(size);
uint8_t bearer_opcode = pdu[0] >> 2; uint8_t bearer_opcode = pdu[0] >> 2;
uint8_t reason; uint8_t reason;
const uint8_t * own_device_uuid; const uint8_t * own_device_uuid;
@ -356,6 +359,8 @@ static void pb_adv_outgoing_transation_complete(uint8_t status){
} }
static void pb_adv_handle_transaction_ack(uint8_t transaction_nr, const uint8_t * pdu, uint16_t size){ static void pb_adv_handle_transaction_ack(uint8_t transaction_nr, const uint8_t * pdu, uint16_t size){
UNUSED(pdu);
UNUSED(size);
if (transaction_nr == pb_adv_msg_out_transaction_nr){ if (transaction_nr == pb_adv_msg_out_transaction_nr){
printf("PB-ADV: %02x ACK received\n", transaction_nr); printf("PB-ADV: %02x ACK received\n", transaction_nr);
pb_adv_outgoing_transation_complete(ERROR_CODE_SUCCESS); pb_adv_outgoing_transation_complete(ERROR_CODE_SUCCESS);
@ -401,10 +406,14 @@ static void pb_adv_handler(uint8_t packet_type, uint16_t channel, uint8_t *packe
uint8_t generic_provisioning_control; uint8_t generic_provisioning_control;
switch(packet[0]){ switch(packet[0]){
case GAP_EVENT_ADVERTISING_REPORT: case GAP_EVENT_ADVERTISING_REPORT:
// data starts at offset 12
data = gap_event_advertising_report_get_data(packet); data = &packet[12];
// PDB ADV PDU // PDB ADV PDU
length = data[0]; length = data[0];
// validate length field
if ((12 + length) > size) return;
link_id = big_endian_read_32(data, 2); link_id = big_endian_read_32(data, 2);
transaction_nr = data[6]; transaction_nr = data[6];
// generic provision PDU // generic provision PDU