diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c b/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c index 4e1f76f6369..b712da9b796 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c @@ -241,7 +241,7 @@ void BTA_GATTS_AddCharacteristic (UINT16 service_id, const tBT_UUID * p_char_u p_buf->attr_val.attr_max_len = attr_val->attr_max_len; p_buf->attr_val.attr_val = (uint8_t *)osi_malloc(len); if(p_buf->attr_val.attr_val != NULL){ - memcpy(p_buf->attr_val.attr_val, attr_val->attr_val, attr_val->attr_len); + memcpy(p_buf->attr_val.attr_val, attr_val->attr_val, len); } } @@ -411,6 +411,14 @@ void BTA_GATTS_StopService(UINT16 service_id) void BTA_GATTS_HandleValueIndication (UINT16 conn_id, UINT16 attr_id, UINT16 data_len, UINT8 *p_data, BOOLEAN need_confirm) { + + /* Validate data length against buffer size */ + if (data_len > BTA_GATT_MAX_ATTR_LEN) { + APPL_TRACE_ERROR("GATT indication data too large: %u > %u", + data_len, BTA_GATT_MAX_ATTR_LEN); + return; + } + tBTA_GATTS_API_INDICATION *p_buf; UINT16 len = sizeof(tBTA_GATTS_API_INDICATION); diff --git a/components/bt/host/bluedroid/bta/hd/bta_hd_api.c b/components/bt/host/bluedroid/bta/hd/bta_hd_api.c index 33875b957a4..36aa540d295 100644 --- a/components/bt/host/bluedroid/bta/hd/bta_hd_api.c +++ b/components/bt/host/bluedroid/bta/hd/bta_hd_api.c @@ -89,6 +89,20 @@ void BTA_HdDisable(void) ******************************************************************************/ extern void BTA_HdRegisterApp(tBTA_HD_APP_INFO *p_app_info, tBTA_HD_QOS_INFO *p_in_qos, tBTA_HD_QOS_INFO *p_out_qos) { + + /* Validate descriptor length before copying */ + if (p_app_info->descriptor.dl_len > BTA_HD_APP_DESCRIPTOR_LEN) { + APPL_TRACE_ERROR("HID descriptor too large: %u > %u", + p_app_info->descriptor.dl_len, BTA_HD_APP_DESCRIPTOR_LEN); + return; + } + + /* Validate descriptor data pointer */ + if (p_app_info->descriptor.dl_len > 0 && p_app_info->descriptor.dsc_list == NULL) { + APPL_TRACE_ERROR("HID descriptor data NULL but length > 0: %u", p_app_info->descriptor.dl_len); + return; + } + tBTA_HD_REGISTER_APP *p_buf; APPL_TRACE_API("%s", __func__); if ((p_buf = (tBTA_HD_REGISTER_APP *)osi_malloc(sizeof(tBTA_HD_REGISTER_APP))) != NULL) { @@ -158,6 +172,13 @@ extern void BTA_HdSendReport(tBTA_HD_REPORT *p_report) __func__, p_report->len, BTA_HD_REPORT_LEN); return; } + + /* Validate report data pointer */ + if (p_report->len > 0 && p_report->p_data == NULL) { + APPL_TRACE_ERROR("HID report data pointer NULL but length > 0: %d", p_report->len); + return; + } + if ((p_buf = (tBTA_HD_SEND_REPORT *)osi_malloc(sizeof(tBTA_HD_SEND_REPORT))) != NULL) { p_buf->hdr.event = BTA_HD_API_SEND_REPORT_EVT; p_buf->use_intr = p_report->use_intr; diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c b/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c index 6dc3ec02dd6..7c89ed004d7 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c @@ -263,6 +263,18 @@ void bta_hh_parse_keybd_rpt(tBTA_HH_BOOT_RPT *p_kb_data, UINT8 *p_report, UINT16 xx, yy, key_idx = 0; UINT8 this_report[BTA_HH_MAX_RPT_CHARS]; + /* Validate report length before processing */ + if (report_len > BTA_HH_MAX_RPT_CHARS) { + APPL_TRACE_ERROR("HID report length exceeds maximum: %u > %u", + report_len, BTA_HH_MAX_RPT_CHARS); + return; + } + + if (report_len == 0 || p_report == NULL) { + APPL_TRACE_ERROR("Invalid HID report data"); + return; + } + #if BTA_HH_DEBUG APPL_TRACE_DEBUG("bta_hh_parse_keybd_rpt: (report=%p, report_len=%d) called", p_report, report_len); @@ -463,7 +475,7 @@ void bta_hh_cleanup_disable(tBTA_HH_STATUS status) if (bta_hh_cb.p_cback) { (*bta_hh_cb.p_cback)(BTA_HH_DISABLE_EVT, (tBTA_HH*)&status); - /* all connections are down, no waiting for diconnect */ + /* all connections are down, no waiting for disconnect */ memset(&bta_hh_cb, 0, sizeof(tBTA_HH_CB)); } } diff --git a/components/bt/host/bluedroid/hci/hci_hal_h4.c b/components/bt/host/bluedroid/hci/hci_hal_h4.c index 134e128ebfb..c66f61692f5 100644 --- a/components/bt/host/bluedroid/hci/hci_hal_h4.c +++ b/components/bt/host/bluedroid/hci/hci_hal_h4.c @@ -508,9 +508,10 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet) STREAM_TO_UINT8(length, stream); } - if ((length + hdr_size) != packet->len) { - HCI_TRACE_ERROR("Wrong packet length type=%d hdr_len=%d pd_len=%d " - "pkt_len=%d", type, hdr_size, length, packet->len); + // Prevents integer wrap-around when calculating (length + hdr_size). + if (length != (packet->len - hdr_size)) { + HCI_TRACE_ERROR("%s: SECURITY: parameter length (%d) exceeds packet bounds (%d)", + __func__, length, packet->len - hdr_size); osi_free(packet); return; } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c index 626e29aacb2..829fab2ab6b 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c @@ -3113,6 +3113,13 @@ void btm_ble_cache_adv_data(BD_ADDR bda, tBTM_INQ_RESULTS *p_cur, UINT8 data_len p_cur->scan_rsp_len = 0; } + /* Additional validation to prevent potential integer overflow */ + if (data_len > BTM_BLE_CACHE_ADV_DATA_MAX) { + BTM_TRACE_ERROR("BLE advertising data length exceeds maximum: %u > %u", + data_len, BTM_BLE_CACHE_ADV_DATA_MAX); + return; + } + if (data_len > 0) { p_cache = &p_le_inq_cb->adv_data_cache[p_le_inq_cb->adv_len]; if((data_len + p_le_inq_cb->adv_len) <= BTM_BLE_CACHE_ADV_DATA_MAX) {