From 6723edeb5cd11d00df7595a6dbb3c6ef5501bfad Mon Sep 17 00:00:00 2001 From: Luo Xu Date: Mon, 6 Jul 2026 17:43:54 +0800 Subject: [PATCH] fix(ble_mesh): fixed BLE-Mesh NimBLE extended-adv reassembly buffer overflow on COMPLETE fragment (cherry picked from commit 1b22467f63311dd3a5f2c354d01e62d51ce18658) Co-authored-by: luoxu --- components/bt/esp_ble_mesh/core/nimble_host/adapter.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c index 9608762a417..b634d3befd2 100644 --- a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c +++ b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c @@ -538,6 +538,10 @@ int disc_cb(struct ble_gap_event *event, void *arg) switch (desc->data_status) { case BLE_GAP_EXT_ADV_DATA_STATUS_COMPLETE: if (adv_report_cache.adv_data_len) { + if (adv_report_cache.adv_data_len + desc->length_data > BLE_MESH_GAP_ADV_MAX_LEN) { + memset(&adv_report_cache, 0, sizeof(adv_report_cache)); + return false; + } memcpy(adv_report_cache.adv_data + adv_report_cache.adv_data_len, desc->data, desc->length_data); adv_report_cache.adv_data_len += desc->length_data;