From 35cd10fbdf99f0165bf34cc03dd5e4baf2e84aa5 Mon Sep 17 00:00:00 2001 From: luoxu Date: Thu, 2 Jul 2026 14:12:40 +0800 Subject: [PATCH] fix(ble_mesh): reject invalid chunk size --- components/bt/esp_ble_mesh/v1.1/mbt/blob_cli.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/components/bt/esp_ble_mesh/v1.1/mbt/blob_cli.c b/components/bt/esp_ble_mesh/v1.1/mbt/blob_cli.c index a5d36d8fa83..b1fc64492b9 100644 --- a/components/bt/esp_ble_mesh/v1.1/mbt/blob_cli.c +++ b/components/bt/esp_ble_mesh/v1.1/mbt/blob_cli.c @@ -1398,6 +1398,10 @@ static int handle_block_status(const struct bt_mesh_model *mod, struct bt_mesh_m size_t len; int idx; + if (!cli->xfer) { + return -EINVAL; + } + target = target_get(cli, ctx->addr); if (!target) { return -ENOENT; @@ -1408,8 +1412,8 @@ static int handle_block_status(const struct bt_mesh_model *mod, struct bt_mesh_m status.missing = status_and_format >> 6; status.block.number = net_buf_simple_pull_le16(buf); chunk_size = net_buf_simple_pull_le16(buf); - if (chunk_size == 0) { - BT_ERR("Invalid chunk_size: 0"); + if (chunk_size == 0 || chunk_size != cli->xfer->chunk_size) { + BT_ERR("Invalid chunk_size: %d,%d", chunk_size, cli->xfer->chunk_size); return -EINVAL; } status.block.chunk_count =