Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/oob_in_bta_dm_sdp_result_v5.4' into 'release/v5.4'

Browse Source 
fix(bt/blurdoird): fixed an OOB write in bta_dm_sdp_result (v5.4)

See merge request espressif/esp-idf!43204
This commit is contained in:
Wang Meng Yang
2025-11-14 17:55:37 +08:00
parent 2e20edcdc7 3286e45349
commit 5d1bfef29c
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/common/include/bt_common.h
+1
View File
@@ -238,6 +238,7 @@ typedef uint64_t UINT64;
typedef bool BOOLEAN; typedef bool BOOLEAN;
/* Maximum UUID size - 16 bytes, and structure to hold any type of UUID. */ /* Maximum UUID size - 16 bytes, and structure to hold any type of UUID. */
#define MAX_UUID_SIZE 16 #define MAX_UUID_SIZE 16
#define MAX_UUID_NUM 32
typedef struct { typedef struct {
#define LEN_UUID_16 2 #define LEN_UUID_16 2
components/bt/host/bluedroid/bta/dm/bta_dm_act.c
+14 -5
View File
@@ -2056,7 +2056,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
#endif #endif
UINT32 num_uuids = 0; UINT32 num_uuids = 0;
UINT8 uuid_list[32][MAX_UUID_SIZE]; // assuming a max of 32 services UINT8 uuid_list[MAX_UUID_NUM][MAX_UUID_SIZE]; // assuming a max of MAX_UUID_NUM services
if ((p_data->sdp_event.sdp_result == SDP_SUCCESS) if ((p_data->sdp_event.sdp_result == SDP_SUCCESS)
|| (p_data->sdp_event.sdp_result == SDP_NO_RECS_MATCH) || (p_data->sdp_event.sdp_result == SDP_NO_RECS_MATCH)
@@ -2119,8 +2119,12 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
(tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index - 1)); (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index - 1));
tmp_svc = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index - 1]; tmp_svc = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index - 1];
/* Add to the list of UUIDs */ /* Add to the list of UUIDs */
sdpu_uuid16_to_uuid128(tmp_svc, uuid_list[num_uuids]); if (num_uuids < MAX_UUID_NUM) {
num_uuids++; sdpu_uuid16_to_uuid128(tmp_svc, uuid_list[num_uuids]);
num_uuids++;
} else {
APPL_TRACE_WARNING("only process the first %d records\n", MAX_UUID_NUM);
}
} }
} }
} }
@@ -2154,8 +2158,13 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
p_sdp_rec = SDP_FindServiceInDb_128bit(bta_dm_search_cb.p_sdp_db, p_sdp_rec); p_sdp_rec = SDP_FindServiceInDb_128bit(bta_dm_search_cb.p_sdp_db, p_sdp_rec);
if (p_sdp_rec) { if (p_sdp_rec) {
if (SDP_FindServiceUUIDInRec_128bit(p_sdp_rec, &temp_uuid)) { if (SDP_FindServiceUUIDInRec_128bit(p_sdp_rec, &temp_uuid)) {
memcpy(uuid_list[num_uuids], temp_uuid.uu.uuid128, MAX_UUID_SIZE); if (num_uuids < MAX_UUID_NUM) {
num_uuids++; memcpy(uuid_list[num_uuids], temp_uuid.uu.uuid128, MAX_UUID_SIZE);
num_uuids++;
} else {
APPL_TRACE_WARNING("only process the first %d records\n", MAX_UUID_NUM);
break;
}
} }
} }
} while (p_sdp_rec); } while (p_sdp_rec);