From 6ee39ea7ca8401ae21d0e3fcab2a45dd78702316 Mon Sep 17 00:00:00 2001 From: Zhang Hai Peng Date: Tue, 30 Dec 2025 11:53:34 +0800 Subject: [PATCH] fix(ble/bluedroid): Fix integer underflow in gatt_process_read_by_type_rsp (cherry picked from commit 597fc6e5c1b4a0448ad3d43185d9d48624085a0c) Co-authored-by: zhanghaipeng --- components/bt/host/bluedroid/stack/gatt/gatt_cl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_cl.c b/components/bt/host/bluedroid/stack/gatt/gatt_cl.c index ddd089f4e02..1cc9aefb479 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_cl.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_cl.c @@ -800,6 +800,14 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 handle_len = 4; } + /* Check value_len is sufficient before subtraction to prevent underflow */ + if (value_len < handle_len) { + GATT_TRACE_ERROR("gatt_process_read_by_type_rsp: value_len(%d) < handle_len(%d), invalid response", + value_len, handle_len); + gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL); + return; + } + value_len -= handle_len; /* subtract the handle pairs bytes */ len -= 1;