From cec99a9f9a21fec928285b978f9b605eb4ffee24 Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Mon, 13 Oct 2025 09:24:08 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete --- components/bt/host/bluedroid/stack/btm/btm_acl.c | 13 ++++++++++++- .../bt/host/bluedroid/stack/btm/include/btm_int.h | 2 +- components/bt/host/bluedroid/stack/btu/btu_hcif.c | 2 +- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/components/bt/host/bluedroid/stack/btm/btm_acl.c b/components/bt/host/bluedroid/stack/btm/btm_acl.c index 765eb726380..687c067c56f 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_acl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_acl.c @@ -2428,7 +2428,7 @@ void btm_read_channel_map_complete(UINT8 *p) ** Returns void ** *******************************************************************************/ -void btm_read_rssi_complete (UINT8 *p) +void btm_read_rssi_complete (UINT8 *p, UINT16 evt_len) { tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_rssi_cmpl_cb; tBTM_RSSI_RESULTS results; @@ -2441,11 +2441,21 @@ void btm_read_rssi_complete (UINT8 *p) btm_cb.devcb.p_rssi_cmpl_cb = NULL; if (p_cb) { + if (evt_len < 1) { + BTM_TRACE_ERROR("Bogus event packet, too short"); + results.status = BTM_ERR_PROCESSING; + goto err_out; + } STREAM_TO_UINT8 (results.hci_status, p); if (results.hci_status == HCI_SUCCESS) { results.status = BTM_SUCCESS; + if (evt_len < 1 + 3) { + BTM_TRACE_ERROR("Bogus event packet, too short"); + results.status = BTM_ERR_PROCESSING; + goto err_out; + } STREAM_TO_UINT16 (handle, p); STREAM_TO_UINT8 (results.rssi, p); @@ -2461,6 +2471,7 @@ void btm_read_rssi_complete (UINT8 *p) results.status = BTM_ERR_PROCESSING; } +err_out: (*p_cb)(&results); } } diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_int.h index 58c9a0aa922..e1036b91744 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_int.h @@ -1071,7 +1071,7 @@ void btm_cont_rswitch (tACL_CONN *p, tACL_CONN *btm_handle_to_acl (UINT16 hci_handle); void btm_read_link_policy_complete (UINT8 *p); -void btm_read_rssi_complete (UINT8 *p); +void btm_read_rssi_complete (UINT8 *p, UINT16 evt_len); void btm_read_channel_map_complete (UINT8 *p); void btm_read_tx_power_complete (UINT8 *p, UINT16 evt_len, BOOLEAN is_ble); void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types); diff --git a/components/bt/host/bluedroid/stack/btu/btu_hcif.c b/components/bt/host/bluedroid/stack/btu/btu_hcif.c index 847e8a05d48..2ff53852e0f 100644 --- a/components/bt/host/bluedroid/stack/btu/btu_hcif.c +++ b/components/bt/host/bluedroid/stack/btu/btu_hcif.c @@ -1153,7 +1153,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l btm_read_local_name_complete (p, evt_len); break; case HCI_READ_RSSI: - btm_read_rssi_complete (p); + btm_read_rssi_complete (p, evt_len); break; case HCI_BLE_READ_CHNL_MAP: btm_read_channel_map_complete (p);