Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble_mesh): added max dfd srv count limit

Browse Source 
(cherry picked from commit 781218cb62)

Co-authored-by: luoxu <luoxu@espressif.com>
This commit is contained in:
Luo Xu
2026-07-06 17:44:10 +08:00
parent 7e9f17dc71
commit d309c58bd7
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/esp_ble_mesh/Kconfig.in
+9
View File
@@ -1875,6 +1875,15 @@ if BLE_MESH
help help
Enable the Device Distribution Client model Enable the Device Distribution Client model
if BLE_MESH_DFD_CLI
config BLE_MESH_DFD_CLI_SRV_TARGETS_MAX
int "Number of DFD SRVs can be accepted"
default 3
range 1 100
help
The maximum number of DFD SRVs that can be accepted.
endif
config BLE_MESH_DFD_SRV config BLE_MESH_DFD_SRV
bool "Support for Firmware Distribution Server model" bool "Support for Firmware Distribution Server model"
depends on BLE_MESH_BLOB_SRV depends on BLE_MESH_BLOB_SRV
components/bt/esp_ble_mesh/v1.1/dfu/dfd_cli.c
+12
View File
@@ -142,8 +142,20 @@ static void handle_receiver_list(struct bt_mesh_model *model,
dfd_status_t status = {0}; dfd_status_t status = {0};
status.receiver_list.entries_cnt = net_buf_simple_pull_le16(buf); status.receiver_list.entries_cnt = net_buf_simple_pull_le16(buf);
if (status.receiver_list.entries_cnt > CONFIG_BLE_MESH_DFD_CLI_SRV_TARGETS_MAX) {
BT_ERR("InvalidDfdSrvEntries:%d",status.receiver_list.entries_cnt);
return;
}
status.receiver_list.first_index = net_buf_simple_pull_le16(buf); status.receiver_list.first_index = net_buf_simple_pull_le16(buf);
status.receiver_list.entries = bt_mesh_calloc(status.receiver_list.entries_cnt * sizeof(target_node_entry_t)); status.receiver_list.entries = bt_mesh_calloc(status.receiver_list.entries_cnt * sizeof(target_node_entry_t));
if (status.receiver_list.entries == NULL) {
BT_ERR("MemAllocFailedForSz:%d",status.receiver_list.entries_cnt * sizeof(target_node_entry_t));
return;
}
for (i = 0; i < status.receiver_list.entries_cnt; i++) { for (i = 0; i < status.receiver_list.entries_cnt; i++) {
target_info = net_buf_simple_pull_le32(buf); target_info = net_buf_simple_pull_le32(buf);
status.receiver_list.entries[i].addr = TARGET_ADDR(target_info); status.receiver_list.entries[i].addr = TARGET_ADDR(target_info);