Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/blufi): Add DH param length validation

Browse Source 
(cherry picked from commit 773814c087)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2025-12-03 11:54:28 +08:00
parent 644d89f133
commit 78a5bb38bb
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/blufi/main/blufi_security.c
+8
View File
@@ -41,6 +41,7 @@
struct blufi_security { struct blufi_security {
#define DH_SELF_PUB_KEY_LEN 128 #define DH_SELF_PUB_KEY_LEN 128
#define DH_PARAM_LEN_MAX 1024
uint8_t self_public_key[DH_SELF_PUB_KEY_LEN]; uint8_t self_public_key[DH_SELF_PUB_KEY_LEN];
#define SHARE_KEY_LEN 128 #define SHARE_KEY_LEN 128
uint8_t share_key[SHARE_KEY_LEN]; uint8_t share_key[SHARE_KEY_LEN];
@@ -83,6 +84,13 @@ void blufi_dh_negotiate_data_handler(uint8_t *data, int len, uint8_t **output_da
switch (type) { switch (type) {
case SEC_TYPE_DH_PARAM_LEN: case SEC_TYPE_DH_PARAM_LEN:
blufi_sec->dh_param_len = ((data[1]<<8)|data[2]); blufi_sec->dh_param_len = ((data[1]<<8)|data[2]);
// Security fix: Limit DH param length to prevent DoS via large memory allocation
if (blufi_sec->dh_param_len == 0 || blufi_sec->dh_param_len > DH_PARAM_LEN_MAX) {
BLUFI_ERROR("%s, invalid dh param len %d\n", __func__, blufi_sec->dh_param_len);
blufi_sec->dh_param_len = 0;
btc_blufi_report_error(ESP_BLUFI_DH_PARAM_ERROR);
return;
}
if (blufi_sec->dh_param) { if (blufi_sec->dh_param) {
free(blufi_sec->dh_param); free(blufi_sec->dh_param);
blufi_sec->dh_param = NULL; blufi_sec->dh_param = NULL;