Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): validate SMP pair-fail reason and OOB device

Browse Source 
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
This commit is contained in:
Zhi Wei Jian
2026-07-14 12:04:23 +08:00
parent 179ea3578f
commit 273c463497
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/smp/smp_act.c
+11 -2
View File
@@ -522,8 +522,17 @@ void smp_proc_sec_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
*******************************************************************************/ *******************************************************************************/
void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
{ {
SMP_TRACE_DEBUG("%s", __func__); UINT8 reason = *(UINT8 *)p_data;
p_cb->status = *(UINT8 *)p_data;
SMP_TRACE_DEBUG("%s reason=0x%02x", __func__, reason);
/* A peer may send a reserved or out-of-range reason code; normalize it so
* upper layers always receive a defined pairing failure status. */
if (reason == SMP_SUCCESS || reason > SMP_MAX_FAIL_RSN_PER_SPEC) {
SMP_TRACE_WARNING("%s invalid pairing fail reason 0x%02x", __func__, reason);
reason = SMP_PAIR_FAIL_UNKNOWN;
}
p_cb->status = reason;
p_cb->failure = reason;
} }
/******************************************************************************* /*******************************************************************************
components/bt/host/bluedroid/stack/smp/smp_api.c
+11
View File
@@ -443,6 +443,17 @@ void SMP_OobDataReply(BD_ADDR bd_addr, tSMP_STATUS res, UINT8 len, UINT8 *p_data
return; return;
} }
/* Reject an OOB reply that does not match the device currently pairing. */
if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
SMP_TRACE_ERROR("%s() - Wrong BD Addr", __func__);
return;
}
if (btm_find_dev(bd_addr) == NULL) {
SMP_TRACE_ERROR("%s() - no dev CB", __func__);
return;
}
if (res != SMP_SUCCESS || len == 0 || !p_data) { if (res != SMP_SUCCESS || len == 0 || !p_data) {
SMP_TRACE_ERROR("%s pairing failed, res=0x%x len=%u p_data=%p", SMP_TRACE_ERROR("%s pairing failed, res=0x%x len=%u p_data=%p",
__func__, res, len, p_data); __func__, res, len, p_data);