Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete

Browse Source
This commit is contained in:
Jin Cheng
2025-10-13 09:24:08 +08:00
parent 7a45769e25
commit 0f9b02dd95
3 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
components/bt/host/bluedroid/stack/btm/btm_acl.c
View File

@@ -2428,7 +2428,7 @@ void btm_read_channel_map_complete(UINT8 *p)
** Returns void
**
*******************************************************************************/
void btm_read_rssi_complete (UINT8 *p)
void btm_read_rssi_complete (UINT8 *p, UINT16 evt_len)
{
tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
tBTM_RSSI_RESULTS results;
@@ -2441,11 +2441,21 @@ void btm_read_rssi_complete (UINT8 *p)
btm_cb.devcb.p_rssi_cmpl_cb = NULL;
if (p_cb) {
if (evt_len < 1) {
BTM_TRACE_ERROR("Bogus event packet, too short");
results.status = BTM_ERR_PROCESSING;
goto err_out;
}
STREAM_TO_UINT8 (results.hci_status, p);
if (results.hci_status == HCI_SUCCESS) {
results.status = BTM_SUCCESS;
if (evt_len < 1 + 3) {
BTM_TRACE_ERROR("Bogus event packet, too short");
results.status = BTM_ERR_PROCESSING;
goto err_out;
}
STREAM_TO_UINT16 (handle, p);
STREAM_TO_UINT8 (results.rssi, p);
@@ -2461,6 +2471,7 @@ void btm_read_rssi_complete (UINT8 *p)
results.status = BTM_ERR_PROCESSING;
}
err_out:
(*p_cb)(&results);
}
}

2
components/bt/host/bluedroid/stack/btm/include/btm_int.h
View File

@@ -1074,7 +1074,7 @@ void btm_cont_rswitch (tACL_CONN *p,
tACL_CONN *btm_handle_to_acl (UINT16 hci_handle);
void btm_read_link_policy_complete (UINT8 *p);
void btm_read_rssi_complete (UINT8 *p);
void btm_read_rssi_complete (UINT8 *p, UINT16 evt_len);
void btm_read_channel_map_complete (UINT8 *p);
void btm_read_tx_power_complete (UINT8 *p, UINT16 evt_len, BOOLEAN is_ble);
void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types);

2
components/bt/host/bluedroid/stack/btu/btu_hcif.c
View File

@@ -1207,7 +1207,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
btm_read_local_name_complete (p, evt_len);
break;
case HCI_READ_RSSI:
btm_read_rssi_complete (p);
btm_read_rssi_complete (p, evt_len);
break;
case HCI_BLE_READ_CHNL_MAP:
btm_read_channel_map_complete (p);