Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/hid_host_oob_read_v6.1' into 'release/v6.1'

Browse Source 
fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act (v6.1)

See merge request espressif/esp-idf!50971
This commit is contained in:
Wang Meng Yang
2026-08-28 14:31:25 +08:00
parent 929a3f18d3 faee9ea49d
commit af7a66da7c
1 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
components/bt/host/bluedroid/bta/hh/bta_hh_act.c
View File

@@ -750,9 +750,20 @@ void bta_hh_handsk_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
*******************************************************************************/
void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
{
BT_HDR *pdata = p_data->hid_cback.p_data;
UINT8 *data = (UINT8 *)(pdata + 1) + pdata->offset;
tBTA_HH_HSDATA hs_data;
BT_HDR *pdata = NULL;
UINT8 *data = NULL;
tBTA_HH_HSDATA hs_data = {0};
if (p_cb == NULL) {
return;
}
if (p_data == NULL || (pdata = p_data->hid_cback.p_data) == NULL) {
APPL_TRACE_ERROR("NULL ctrl data %p,%p for w4_evt=%d", p_data, pdata, p_cb->w4_evt);
hs_data.status = BTA_HH_ERR;
hs_data.handle = p_cb->hid_handle;
goto _exit;
}
#if BTA_HH_DEBUG
APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",
@@ -760,15 +771,26 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
#endif
hs_data.status = BTA_HH_OK;
hs_data.handle = p_cb->hid_handle;
data = (UINT8 *)(pdata + 1) + pdata->offset;
switch (p_cb->w4_evt) {
case BTA_HH_GET_IDLE_EVT:
if (pdata->len < 1) {
APPL_TRACE_ERROR("GET_IDLE with insufficient length %u", pdata->len);
hs_data.status = BTA_HH_ERR;
break;
}
hs_data.rsp_data.idle_rate = *data;
break;
case BTA_HH_GET_RPT_EVT:
hs_data.rsp_data.p_rpt_data = pdata;
break;
case BTA_HH_GET_PROTO_EVT:
if (pdata->len < 1) {
APPL_TRACE_ERROR("GET_PROTO with insufficient length %u", pdata->len);
hs_data.status = BTA_HH_ERR;
break;
}
/* match up BTE/BTA report/boot mode def*/
hs_data.rsp_data.proto_mode = ((*data) == HID_PAR_PROTOCOL_REPORT) ? \
BTA_HH_PROTO_RPT_MODE : BTA_HH_PROTO_BOOT_MODE;
@@ -796,6 +818,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
bta_sys_busy(BTA_ID_HH, p_cb->app_id, p_cb->addr);
bta_sys_idle(BTA_ID_HH, p_cb->app_id, p_cb->addr);
_exit:
(* bta_hh_cb.p_cback)(p_cb->w4_evt, (tBTA_HH *)&hs_data);
p_cb->w4_evt = 0;