Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): Fixed memory out-of-bounds issue when parsing adv data

Browse Source
This commit is contained in:
zhanghaipeng
2024-09-07 12:25:10 +08:00
parent cef46b3cef
commit af9ebecc1d
14 changed files with 118 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/esp_hid_device/main/esp_hid_gap.c
+16 -4
View File
@@ -358,22 +358,34 @@ static void handle_ble_device_result(struct ble_scan_result_evt_param *scan_rst)
char name[64] = {0};
uint8_t uuid_len = 0;
uint8_t *uuid_d = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_16SRV_CMPL, &uuid_len);
uint8_t *uuid_d = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_16SRV_CMPL,
&uuid_len);
if (uuid_d != NULL && uuid_len) {
uuid = uuid_d[0] + (uuid_d[1] << 8);
}
uint8_t appearance_len = 0;
uint8_t *appearance_d = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_APPEARANCE, &appearance_len);
uint8_t *appearance_d = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_APPEARANCE,
&appearance_len);
if (appearance_d != NULL && appearance_len) {
appearance = appearance_d[0] + (appearance_d[1] << 8);
}
uint8_t adv_name_len = 0;
uint8_t *adv_name = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_NAME_CMPL, &adv_name_len);
uint8_t *adv_name = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_CMPL,
&adv_name_len);
if (adv_name == NULL) {
adv_name = esp_ble_resolve_adv_data(scan_rst->ble_adv, ESP_BLE_AD_TYPE_NAME_SHORT, &adv_name_len);
adv_name = esp_ble_resolve_adv_data_by_type(scan_rst->ble_adv,
scan_rst->adv_data_len + scan_rst->scan_rsp_len,
ESP_BLE_AD_TYPE_NAME_SHORT,
&adv_name_len);
}
if (adv_name != NULL && adv_name_len) {