Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-07-16 16:03:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/bbp_499' into 'master'

Browse Source 
fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received

Closes BT-4389

See merge request espressif/esp-idf!49429
This commit is contained in:
Wang Meng Yang
2026-06-11 12:36:20 +08:00
parent 388ea06692 d6a49aedef
commit 9a3bfb907c
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
components/bt/host/bluedroid/stack/smp/smp_l2c.c
View File

@@ -335,13 +335,15 @@ static void smp_br_data_received(UINT16 channel, BD_ADDR bd_addr, BT_HDR *p_buf)
return;
}
/* Validate command length to prevent out-of-bounds read in handler functions */
if (p_buf->len != smp_cmd_size_per_spec[cmd]) {
SMP_TRACE_WARNING( "Ignore received command 0x%02x with invalid length %d", cmd, p_buf->len);
osi_free(p_buf);
return;
}
/* reject the pairing request if there is an on-going SMP pairing */
if (SMP_OPCODE_PAIRING_REQ == cmd) {
if (p_buf->len != smp_cmd_size_per_spec[cmd]) {
SMP_TRACE_WARNING( "Ignore received command 0x%02x with invalid length %d", cmd, p_buf->len);
osi_free(p_buf);
return;
}
if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE)) {
p_cb->role = HCI_ROLE_SLAVE;
p_cb->smp_over_br = TRUE;