Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item

Browse Source
This commit is contained in:
Jin Cheng
2025-12-19 11:17:18 +08:00
parent 1f891f31a5
commit 7d333a6324
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c
+6 -2
View File
@@ -362,6 +362,10 @@ static void bta_hf_client_handle_cind_list_item(char *name, UINT32 min, UINT32 m
APPL_TRACE_DEBUG("%s %u.%s <%u:%u>", __FUNCTION__, index, name, min, max); APPL_TRACE_DEBUG("%s %u.%s <%u:%u>", __FUNCTION__, index, name, min, max);
if (index >= BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
return;
}
/* look for a matching indicator on list of supported ones */ /* look for a matching indicator on list of supported ones */
for (i = 0; i < BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT; i++) { for (i = 0; i < BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT; i++) {
if (strcmp(name, BTA_HF_CLIENT_INDICATOR_SERVICE) == 0) { if (strcmp(name, BTA_HF_CLIENT_INDICATOR_SERVICE) == 0) {
@@ -1018,7 +1022,7 @@ static char *bta_hf_client_parse_clcc(char *buffer)
} }
} }
/* Skip any remaing param,as they are not defined by BT HFP spec */ /* Skip any remaining param,as they are not defined by BT HFP spec */
AT_SKIP_REST(buffer); AT_SKIP_REST(buffer);
AT_CHECK_RN(buffer); AT_CHECK_RN(buffer);
@@ -1571,7 +1575,7 @@ void bta_hf_client_send_at_xapl(char *information, UINT32 features)
*vendorID: A string representation of the hex value of the vendor ID from the manufacturer, without the 0x prefix. *vendorID: A string representation of the hex value of the vendor ID from the manufacturer, without the 0x prefix.
*productID: A string representation of the hex value of the product ID from the manufacturer, without the 0x prefix. *productID: A string representation of the hex value of the product ID from the manufacturer, without the 0x prefix.
*version: The revision of the software. *version: The revision of the software.
*Fatures: A base-10 representation of a bit field. Available features are: *Features: A base-10 representation of a bit field. Available features are:
*Bit 0 = reserved *Bit 0 = reserved
*Bit 1 = The accessory supports battery reporting (reserved only for battery operated accessories). *Bit 1 = The accessory supports battery reporting (reserved only for battery operated accessories).
*Bit 2 = The accessory is docked or powered (reserved only for battery operated accessories). *Bit 2 = The accessory is docked or powered (reserved only for battery operated accessories).