Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/hci): Fix OOB read in ble_adv_scan_combined example

Browse Source 
(cherry picked from commit c762832600)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2026-01-07 19:28:30 +08:00
committed by BOT
parent a012fee0be
commit 9ad2dd11ad
1 changed files with 48 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/hci/ble_adv_scan_combined/main/app_bt.c
+48 -16
View File
@@ -1,7 +1,7 @@
/* /*
* BLE Combined Advertising and Scanning Example. * BLE Combined Advertising and Scanning Example.
* *
* SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Unlicense OR CC0-1.0 * SPDX-License-Identifier: Unlicense OR CC0-1.0
*/ */
@@ -18,8 +18,10 @@
static const char *TAG = "BLE_ADV_SCAN"; static const char *TAG = "BLE_ADV_SCAN";
#define SCAN_LOCAL_NAME_MAX_LEN 32
typedef struct { typedef struct {
char scan_local_name[32]; char scan_local_name[SCAN_LOCAL_NAME_MAX_LEN];
uint8_t name_len; uint8_t name_len;
} ble_scan_local_name_t; } ble_scan_local_name_t;
@@ -187,28 +189,58 @@ static void hci_cmd_send_ble_set_adv_data(void)
ESP_LOGI(TAG, "Starting BLE advertising with name \"%s\"", adv_name); ESP_LOGI(TAG, "Starting BLE advertising with name \"%s\"", adv_name);
} }
static esp_err_t get_local_name (uint8_t *data_msg, uint8_t data_len, ble_scan_local_name_t *scanned_packet) static esp_err_t get_local_name(uint8_t *data_msg, uint8_t data_len, ble_scan_local_name_t *scanned_packet)
{ {
uint8_t curr_ptr = 0, curr_len, curr_type; uint8_t curr_ptr = 0;
/* Initialize output structure */
scanned_packet->name_len = 0;
scanned_packet->scan_local_name[0] = '\0';
while (curr_ptr < data_len) { while (curr_ptr < data_len) {
curr_len = data_msg[curr_ptr++]; /* Ensure there is at least 1 byte for length field */
curr_type = data_msg[curr_ptr++]; if (curr_ptr >= data_len) {
return ESP_FAIL;
}
uint8_t curr_len = data_msg[curr_ptr++];
/* Length of 0 indicates end of AD structures or invalid data */
if (curr_len == 0) { if (curr_len == 0) {
return ESP_FAIL; return ESP_FAIL;
} }
/* Search for current data type and see if it contains name as data (0x08 or 0x09). */ /* Ensure there is at least 1 byte for type field */
if (curr_type == 0x08 || curr_type == 0x09) { if (curr_ptr >= data_len) {
for (uint8_t i = 0; i < curr_len - 1; i += 1) { return ESP_FAIL;
scanned_packet->scan_local_name[i] = data_msg[curr_ptr + i];
}
scanned_packet->name_len = curr_len - 1;
return ESP_OK;
} else {
/* Search for next data. Current length includes 1 octate for AD Type (2nd octate). */
curr_ptr += curr_len - 1;
} }
uint8_t curr_type = data_msg[curr_ptr++];
/* Calculate data field length (curr_len includes type byte) */
uint8_t data_field_len = curr_len - 1;
/* Verify remaining buffer has enough data */
if (curr_ptr + data_field_len > data_len) {
return ESP_FAIL;
}
/* Check for Local Name type (0x08: Shortened, 0x09: Complete) */
if (curr_type == 0x08 || curr_type == 0x09) {
/* Limit copy length to prevent buffer overflow */
uint8_t copy_len = data_field_len;
if (copy_len > SCAN_LOCAL_NAME_MAX_LEN - 1) {
copy_len = SCAN_LOCAL_NAME_MAX_LEN - 1;
}
memcpy(scanned_packet->scan_local_name, &data_msg[curr_ptr], copy_len);
scanned_packet->scan_local_name[copy_len] = '\0'; /* Ensure null termination */
scanned_packet->name_len = copy_len;
return ESP_OK;
}
/* Move to next AD structure */
curr_ptr += data_field_len;
} }
return ESP_FAIL; return ESP_FAIL;
} }