Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(nimble): Fix vulnerabilities in NimBLE examples

Browse Source
This commit is contained in:
Shreeyash
2026-02-19 10:18:38 +05:30
committed by Rahul Tank
parent 1a2b081be3
commit ba1360baef
43 changed files with 872 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
+28
View File
@@ -102,8 +102,21 @@ enc_adv_data_cent_on_read(uint16_t conn_handle,
value_ead.km = (struct key_material *) malloc (sizeof(struct key_material));
if (value_ead.km == NULL) {
MODLOG_DFLT(ERROR, "Failed to allocate memory for key material");
goto err;
}
memset(value_ead.km, 0, sizeof(struct key_material));
/* Validate mbuf has enough data before copying */
if (attr->om == NULL || OS_MBUF_PKTLEN(attr->om) < (BLE_EAD_KEY_SIZE + BLE_EAD_IV_SIZE)) {
MODLOG_DFLT(ERROR, "Invalid mbuf or insufficient data size");
free(value_ead.km);
value_ead.km = NULL;
goto err;
}
os_mbuf_copydata(attr->om, 0, BLE_EAD_KEY_SIZE, &value_ead.km->session_key);
os_mbuf_copydata(attr->om, BLE_EAD_KEY_SIZE, BLE_EAD_IV_SIZE, &value_ead.km->iv);
@@ -120,8 +133,17 @@ enc_adv_data_cent_on_read(uint16_t conn_handle,
MODLOG_DFLT(INFO, "Writing of session key, iv, and peer addr to NVS success");
}
if (value_ead.km != NULL) {
free(value_ead.km);
value_ead.km = NULL;
}
err:
/* Terminate the connection. */
if (value_ead.km != NULL) {
free(value_ead.km);
value_ead.km = NULL;
}
return ble_gap_terminate(conn_handle, BLE_ERR_REM_USER_CONN_TERM);
}
@@ -244,6 +266,10 @@ enc_adv_data_cent_decrypt(uint8_t length_data, const uint8_t *data, const uint8_
switch (op) {
case BLE_GAP_ENC_ADV_DATA:
enc_data = (uint8_t *) malloc (sizeof(uint8_t) * len);
if (enc_data == NULL) {
MODLOG_DFLT(ERROR, "Failed to allocate enc_data");
return 0;
}
memcpy(enc_data, data + offset + 2, len);
memcpy(&key_ead.peer_addr.val, peer_addr, PEER_ADDR_VAL_SIZE);
@@ -262,6 +288,7 @@ enc_adv_data_cent_decrypt(uint8_t length_data, const uint8_t *data, const uint8_
MODLOG_DFLT(INFO, "Decryption of adv data done successfully");
} else {
MODLOG_DFLT(INFO, "Decryption of adv data failed");
free(enc_data);
return 0;
}
@@ -272,6 +299,7 @@ enc_adv_data_cent_decrypt(uint8_t length_data, const uint8_t *data, const uint8_
MODLOG_DFLT(INFO, "0x%02X ", temp[i]);
}
MODLOG_DFLT(INFO, "\n");
free(enc_data);
return 1;
default:
examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_prph/main/main.c
+13 -10
View File
@@ -68,8 +68,8 @@ enc_adv_data_prph_print_conn_desc(struct ble_gap_conn_desc *desc)
desc->sec_state.bonded);
}
static void
enc_adv_data_prph_encrypt_set(uint8_t * out_encrypted_adv_data,
static int
enc_adv_data_prph_encrypt_set(uint8_t *out_encrypted_adv_data,
const unsigned encrypted_adv_data_len)
{
int rc;
@@ -85,13 +85,13 @@ enc_adv_data_prph_encrypt_set(uint8_t * out_encrypted_adv_data,
print_bytes(unencrypted_adv_data, unencrypted_adv_data_len);
MODLOG_DFLT(INFO, "\n");
rc = ble_ead_encrypt(km.session_key, km.iv, unencrypted_adv_data, unencrypted_adv_data_len, encrypted_adv_data);
if (rc == 0) {
MODLOG_DFLT(INFO, "Encryption of adv data done successfully");
} else {
MODLOG_DFLT(INFO, "Encryption of adv data failed");
return;
rc = ble_ead_encrypt(km.session_key, km.iv, unencrypted_adv_data,
unencrypted_adv_data_len, encrypted_adv_data);
if (rc != 0) {
MODLOG_DFLT(ERROR, "Encryption of adv data failed; rc=%d", rc);
return rc;
}
MODLOG_DFLT(INFO, "Encryption of adv data done successfully");
MODLOG_DFLT(INFO, "Data after encryption:");
print_bytes(encrypted_adv_data, encrypted_adv_data_len);
@@ -99,6 +99,7 @@ enc_adv_data_prph_encrypt_set(uint8_t * out_encrypted_adv_data,
/** Contains Randomiser ## Encrypted Advertising Data ## MIC */
memcpy(out_encrypted_adv_data, encrypted_adv_data, encrypted_adv_data_len);
return 0;
}
/**
@@ -111,7 +112,6 @@ enc_adv_data_prph_advertise(void)
{
struct ble_gap_adv_params params;
struct ble_hs_adv_fields fields;
uint8_t own_addr_type;
int rc;
const unsigned encrypted_adv_data_len = BLE_EAD_ENCRYPTED_PAYLOAD_SIZE(sizeof(unencrypted_adv_pattern));
@@ -149,7 +149,10 @@ enc_adv_data_prph_advertise(void)
fields.uuids16_is_complete = 1;
/** Getting the encrypted advertising data */
enc_adv_data_prph_encrypt_set(encrypted_adv_data, encrypted_adv_data_len);
rc = enc_adv_data_prph_encrypt_set(encrypted_adv_data, encrypted_adv_data_len);
if (rc != 0) {
return;
}
fields.enc_adv_data = encrypted_adv_data;
fields.enc_adv_data_len = encrypted_adv_data_len;