Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(nimble): Fix vulnerabilities in NimBLE examples

Browse Source
This commit is contained in:
Shreeyash
2026-02-06 18:43:33 +05:30
parent 5adf717cfd
commit dacec1afa1
43 changed files with 893 additions and 316 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/nimble/blecsc/main/gatt_svr.c
+19 -6
View File
@@ -191,6 +191,9 @@ gatt_svr_chr_access_sc_control_point(uint16_t conn_handle,
/* Allocate response buffer */
om_indication = ble_hs_mbuf_att_pkt();
if (om_indication == NULL) {
return BLE_HS_ENOMEM;
}
switch(op_code){
#if (CSC_FEATURES & CSC_FEATURE_WHEEL_REV_DATA)
@@ -200,6 +203,7 @@ gatt_svr_chr_access_sc_control_point(uint16_t conn_handle,
sizeof(new_cumulative_wheel_rev_arr),
new_cumulative_wheel_rev_arr);
if (rc != 0){
os_mbuf_free_chain(om_indication);
return BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN;
}
@@ -216,7 +220,8 @@ gatt_svr_chr_access_sc_control_point(uint16_t conn_handle,
/* Read new sensor location value*/
rc = os_mbuf_copydata(ctxt->om, 1, 1, &new_sensor_location);
if (rc != 0){
return BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN;
os_mbuf_free_chain(om_indication);
return BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN;
}
@@ -244,7 +249,8 @@ gatt_svr_chr_access_sc_control_point(uint16_t conn_handle,
rc = os_mbuf_append(om_indication, &response, sizeof(response));
if (rc != 0){
return BLE_ATT_ERR_INSUFFICIENT_RES;
os_mbuf_free_chain(om_indication);
return BLE_ATT_ERR_INSUFFICIENT_RES;
}
#if (CSC_FEATURES & CSC_FEATURE_MULTIPLE_SENSOR_LOC)
@@ -252,17 +258,24 @@ gatt_svr_chr_access_sc_control_point(uint16_t conn_handle,
if (op_code == SC_CP_OP_REQ_SUPPORTED_SENSOR_LOCATIONS){
rc = os_mbuf_append(om_indication, &csc_supported_sensor_locations,
sizeof(csc_supported_sensor_locations));
}
if (rc != 0){
return BLE_ATT_ERR_INSUFFICIENT_RES;
if (rc != 0){
os_mbuf_free_chain(om_indication);
return BLE_ATT_ERR_INSUFFICIENT_RES;
}
}
#endif
rc = ble_gatts_indicate_custom(conn_handle, csc_control_point_handle,
om_indication);
if (rc != 0) {
goto done;
}
return rc;
done:
os_mbuf_free_chain(om_indication);
return rc;
}
static int