Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(nimble): Fix vulnerabilities in NimBLE examples

Browse Source
This commit is contained in:
Shreeyash
2026-02-19 10:18:38 +05:30
committed by Rahul Tank
parent 1a2b081be3
commit ba1360baef
43 changed files with 872 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/nimble/ble_ancs/main/ble_ancs.c
+6 -1
View File
@@ -103,7 +103,7 @@ char *CategoryID_to_String(uint8_t CategoryID)
void ble_receive_apple_notification_source(uint8_t *message, uint16_t message_len)
{
if (!message || message_len < 5) {
if (!message || message_len < 8) {
return;
}
@@ -126,6 +126,11 @@ void ble_receive_apple_data_source(uint8_t *message, uint16_t message_len)
switch (Command_id)
{
case CommandIDGetNotificationAttributes: {
if (message_len < 5) {
ESP_LOGE(NimBLE_ANCS_TAG, "Invalid message length for attributes: %d",
message_len);
return;
}
uint32_t NotificationUID = (message[1]) | (message[2]<< 8) | (message[3]<< 16) | (message[4] << 24);
uint32_t remain_attr_len = message_len - 5;
uint8_t *attrs = &message[5];
examples/bluetooth/nimble/ble_ancs/main/main.c
+17 -11
View File
@@ -72,7 +72,7 @@ static uint8_t ext_adv_pattern_1[] = {
0x02, BLE_HS_ADV_TYPE_FLAGS, 0x06,
0x03, BLE_HS_ADV_TYPE_COMP_UUIDS16, 0xab, 0xcd,
0x03, BLE_HS_ADV_TYPE_COMP_UUIDS16, 0x18, 0x11,
0x0e, BLE_HS_ADV_TYPE_COMP_NAME, 'n', 'i', 'm', 'b', 'l', 'e', '-', 'a', 'n', 'c', 's', '-', 'e',
0x0d, BLE_HS_ADV_TYPE_COMP_NAME, 'n', 'i', 'm', 'b', 'l', 'e', '-', 'a', 'n', 'c', 's', '-', 'e',
};
#endif
@@ -338,14 +338,14 @@ ext_ble_ancs_advertise(void)
}
/* use defaults for non-set params */
memset (&params, 0, sizeof(params));
memset(&params, 0, sizeof(params));
/* enable connectable advertising */
/* enable connectable, scannable advertising */
params.connectable = 1;
params.scannable = 1;
/* advertise using random addr */
/* advertise using configured addr */
params.own_addr_type = BLE_OWN_ADDR_PUBLIC;
params.primary_phy = BLE_HCI_LE_PHY_1M;
params.secondary_phy = BLE_HCI_LE_PHY_2M;
params.tx_power = 127;
@@ -359,8 +359,6 @@ ext_ble_ancs_advertise(void)
ble_ancs_gap_event, NULL);
assert (rc == 0);
/* in this case only scan response is allowed */
/* get mbuf for scan rsp data */
data = os_msys_get_pkthdr(sizeof(ext_adv_pattern_1), 0);
assert(data);
@@ -369,7 +367,7 @@ ext_ble_ancs_advertise(void)
rc = os_mbuf_append(data, ext_adv_pattern_1, sizeof(ext_adv_pattern_1));
assert(rc == 0);
rc = ble_gap_ext_adv_set_data(instance, data);
rc = ble_gap_ext_adv_rsp_set_data(instance, data);
assert (rc == 0);
/* start advertising */
@@ -576,10 +574,18 @@ ble_ancs_gap_event(struct ble_gap_event *event, void *arg)
notificationUID, sizeof(p_attr)/sizeof(ble_noti_attr_list_t), p_attr);
}
} else if (event->notify_rx.attr_handle == data_source_handle) {
uint16_t new_len = data_buffer.len + event->notify_rx.om->om_len;
if (new_len > sizeof(data_buffer.buffer)) {
MODLOG_DFLT(ERROR, "data_buffer overflow: %d + %d > %d",
data_buffer.len, event->notify_rx.om->om_len,
(int)sizeof(data_buffer.buffer));
data_buffer.len = 0;
return 0;
}
memcpy(&data_buffer.buffer[data_buffer.len],
event->notify_rx.om->om_data,
event->notify_rx.om->om_len);
data_buffer.len += event->notify_rx.om->om_len;
event->notify_rx.om->om_data,
event->notify_rx.om->om_len);
data_buffer.len = new_len;
if (event->notify_rx.om->om_len == (MTU_size - 3)) {
esp_timer_start_periodic(periodic_timer, 500000);