Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): Fix security issues in GATT module

Browse Source 
(cherry picked from commit f502b2aab1)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2025-12-03 11:53:41 +08:00
committed by BLE BOT
parent 32d608fdf5
commit de0d79fa1e
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
components/bt/host/bluedroid/stack/gatt/gatt_db.c
View File

@@ -1039,20 +1039,23 @@ tGATT_STATUS gatts_write_attr_value_by_handle(tGATT_SVC_DB *p_db,
return GATT_APP_RSP;
}
if ((p_attr->p_value != NULL) &&
(p_attr->p_value->attr_val.attr_max_len >= offset + len) &&
p_attr->p_value->attr_val.attr_val != NULL) {
memcpy(p_attr->p_value->attr_val.attr_val + offset, p_value, len);
p_attr->p_value->attr_val.attr_len = len + offset;
return GATT_SUCCESS;
} else if (p_attr->p_value && p_attr->p_value->attr_val.attr_max_len < offset + len){
GATT_TRACE_DEBUG("Remote device try to write with a length larger then attribute's max length\n");
return GATT_INVALID_ATTR_LEN;
} else if ((p_attr->p_value == NULL) || (p_attr->p_value->attr_val.attr_val == NULL)){
if (p_attr->p_value == NULL || p_attr->p_value->attr_val.attr_val == NULL) {
GATT_TRACE_ERROR("Error in %s, line=%d, %s should not be NULL here\n", __func__, __LINE__, \
(p_attr->p_value == NULL) ? "p_value" : "attr_val.attr_val");
return GATT_UNKNOWN_ERROR;
}
/* Check for integer overflow: offset + len must not overflow UINT16
* and must not exceed attr_max_len */
if (offset > p_attr->p_value->attr_val.attr_max_len ||
len > p_attr->p_value->attr_val.attr_max_len - offset) {
GATT_TRACE_DEBUG("Remote device try to write with a length larger than attribute's max length\n");
return GATT_INVALID_ATTR_LEN;
}
memcpy(p_attr->p_value->attr_val.attr_val + offset, p_value, len);
p_attr->p_value->attr_val.attr_len = offset + len;
return GATT_SUCCESS;
}
p_attr = (tGATT_ATTR16 *)p_attr->p_next;