Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete

Browse Source
This commit is contained in:
Jin Cheng
2025-12-19 11:17:18 +08:00
parent 68865736c4
commit 4c5e31394b
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_acl.c
+18 -1
View File
@@ -2300,7 +2300,7 @@ void BTM_BleGetPeriodicAdvListSize(uint8_t *size)
** Returns void ** Returns void
** **
*******************************************************************************/ *******************************************************************************/
void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble) void btm_read_tx_power_complete (UINT8 *p, UINT16 evt_len, BOOLEAN is_ble)
{ {
tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb; tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
tBTM_TX_POWER_RESULTS results; tBTM_TX_POWER_RESULTS results;
@@ -2313,12 +2313,23 @@ void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble)
btm_cb.devcb.p_tx_power_cmpl_cb = NULL; btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
if (p_cb) { if (p_cb) {
if (evt_len < 1) {
BTM_TRACE_ERROR("Bogus event packet, too short\n");
results.status = BTM_ERR_PROCESSING;
goto err_out;
}
STREAM_TO_UINT8 (results.hci_status, p); STREAM_TO_UINT8 (results.hci_status, p);
if (results.hci_status == HCI_SUCCESS) { if (results.hci_status == HCI_SUCCESS) {
results.status = BTM_SUCCESS; results.status = BTM_SUCCESS;
if (!is_ble) { if (!is_ble) {
if (evt_len < 1 + 3) {
BTM_TRACE_ERROR("Bogus event packet, too short\n");
results.status = BTM_ERR_PROCESSING;
goto err_out;
}
STREAM_TO_UINT16 (handle, p); STREAM_TO_UINT16 (handle, p);
STREAM_TO_UINT8 (results.tx_power, p); STREAM_TO_UINT8 (results.tx_power, p);
@@ -2330,6 +2341,11 @@ void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble)
} }
#if BLE_INCLUDED == TRUE #if BLE_INCLUDED == TRUE
else { else {
if (evt_len < 1 + 1) {
BTM_TRACE_ERROR("Bogus event packet, too short\n");
results.status = BTM_ERR_PROCESSING;
goto err_out;
}
STREAM_TO_UINT8 (results.tx_power, p); STREAM_TO_UINT8 (results.tx_power, p);
memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN); memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
} }
@@ -2340,6 +2356,7 @@ void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble)
results.status = BTM_ERR_PROCESSING; results.status = BTM_ERR_PROCESSING;
} }
err_out:
(*p_cb)(&results); (*p_cb)(&results);
} }
} }
components/bt/host/bluedroid/stack/btm/include/btm_int.h
+1 -1
View File
@@ -1076,7 +1076,7 @@ tACL_CONN *btm_handle_to_acl (UINT16 hci_handle);
void btm_read_link_policy_complete (UINT8 *p); void btm_read_link_policy_complete (UINT8 *p);
void btm_read_rssi_complete (UINT8 *p); void btm_read_rssi_complete (UINT8 *p);
void btm_read_channel_map_complete (UINT8 *p); void btm_read_channel_map_complete (UINT8 *p);
void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble); void btm_read_tx_power_complete (UINT8 *p, UINT16 evt_len, BOOLEAN is_ble);
void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types); void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types);
void btm_read_link_quality_complete (UINT8 *p); void btm_read_link_quality_complete (UINT8 *p);
tBTM_STATUS btm_set_packet_types (tACL_CONN *p, UINT16 pkt_types); tBTM_STATUS btm_set_packet_types (tACL_CONN *p, UINT16 pkt_types);
components/bt/host/bluedroid/stack/btu/btu_hcif.c
+2 -2
View File
@@ -1214,7 +1214,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
break; break;
case HCI_READ_TRANSMIT_POWER_LEVEL: case HCI_READ_TRANSMIT_POWER_LEVEL:
#if (BLE_HOST_READ_TX_POWER_EN == TRUE) #if (BLE_HOST_READ_TX_POWER_EN == TRUE)
btm_read_tx_power_complete(p, FALSE); btm_read_tx_power_complete(p, evt_len, FALSE);
#endif // #if (BLE_HOST_READ_TX_POWER_EN == TRUE) #endif // #if (BLE_HOST_READ_TX_POWER_EN == TRUE)
break; break;
#if (CLASSIC_BT_INCLUDED == TRUE) #if (CLASSIC_BT_INCLUDED == TRUE)
@@ -1296,7 +1296,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
case HCI_BLE_READ_ADV_CHNL_TX_POWER: case HCI_BLE_READ_ADV_CHNL_TX_POWER:
#if (BLE_HOST_READ_TX_POWER_EN == TRUE) #if (BLE_HOST_READ_TX_POWER_EN == TRUE)
btm_read_tx_power_complete(p, TRUE); btm_read_tx_power_complete(p, evt_len, TRUE);
#endif // #if (BLE_HOST_READ_TX_POWER_EN == TRUE) #endif // #if (BLE_HOST_READ_TX_POWER_EN == TRUE)
break; break;
#if (BLE_42_ADV_EN == TRUE) #if (BLE_42_ADV_EN == TRUE)