Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): validate SMP pair-fail reason and OOB device

Browse Source
This commit is contained in:
zhiweijian
2026-07-07 17:21:09 +08:00
parent 6c3267ee84
commit 98efe02385
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
components/bt/host/bluedroid/stack/smp/smp_act.c
View File

@@ -522,8 +522,17 @@ void smp_proc_sec_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
*******************************************************************************/
void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
{
SMP_TRACE_DEBUG("%s", __func__);
p_cb->status = *(UINT8 *)p_data;
UINT8 reason = *(UINT8 *)p_data;
SMP_TRACE_DEBUG("%s reason=0x%02x", __func__, reason);
/* A peer may send a reserved or out-of-range reason code; normalize it so
* upper layers always receive a defined pairing failure status. */
if (reason == SMP_SUCCESS || reason > SMP_MAX_FAIL_RSN_PER_SPEC) {
SMP_TRACE_WARNING("%s invalid pairing fail reason 0x%02x", __func__, reason);
reason = SMP_PAIR_FAIL_UNKNOWN;
}
p_cb->status = reason;
p_cb->failure = reason;
}
/*******************************************************************************

11
components/bt/host/bluedroid/stack/smp/smp_api.c
View File

@@ -443,6 +443,17 @@ void SMP_OobDataReply(BD_ADDR bd_addr, tSMP_STATUS res, UINT8 len, UINT8 *p_data
return;
}
/* Reject an OOB reply that does not match the device currently pairing. */
if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
SMP_TRACE_ERROR("%s() - Wrong BD Addr", __func__);
return;
}
if (btm_find_dev(bd_addr) == NULL) {
SMP_TRACE_ERROR("%s() - no dev CB", __func__);
return;
}
if (res != SMP_SUCCESS || len == 0 || !p_data) {
SMP_TRACE_ERROR("%s pairing failed, res=0x%x len=%u p_data=%p",
__func__, res, len, p_data);