From eb8962ae8a36f3ff32c3af5a4fc3909349703986 Mon Sep 17 00:00:00 2001 From: Luo Xu Date: Mon, 6 Jul 2026 17:43:59 +0800 Subject: [PATCH] fix(ble_mesh): Reset reassembly buffer at start of each transaction The reassembly buffer must be reset to its origin at the beginning of every transaction. prov_msg_recv() pulls the PDU type byte (advancing buf->data by one) and nothing restores it between transactions. Without this reset, buf->data drifts forward by one byte per received PDU, causing the segment-0 memcpy to write past the end of the statically allocated rx buffer (PROV_RX_BUF_SIZE), and the XACT_SEG_DATA() offsets used for continuation segments to be skewed by the accumulated drift. (cherry picked from commit 2c4acaa2aaa09566f613f8c6b8c92e5875be020b) Co-authored-by: luoxu --- components/bt/esp_ble_mesh/core/prov_common.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/components/bt/esp_ble_mesh/core/prov_common.c b/components/bt/esp_ble_mesh/core/prov_common.c index 58bbf7bce5c..2e9985e9331 100644 --- a/components/bt/esp_ble_mesh/core/prov_common.c +++ b/components/bt/esp_ble_mesh/core/prov_common.c @@ -199,6 +199,17 @@ bool bt_mesh_gen_prov_start(struct bt_mesh_prov_link *link, return false; } + /* Reset the reassembly buffer so every transaction starts from the + * buffer origin. prov_msg_recv() pulls the PDU type byte (advancing + * buf->data by one) and nothing restores it between transactions, so + * without this reset buf->data would drift forward by one byte per + * received PDU: the segment-0 memcpy below would then write past the + * end of the statically allocated rx buffer (PROV_RX_BUF_SIZE), and + * the XACT_SEG_DATA() offsets used for continuation segments would + * be skewed by the accumulated drift. + */ + net_buf_simple_reset(link->rx.buf); + link->rx.buf->len = net_buf_simple_pull_be16(buf); link->rx.id = rx->xact_id; link->rx.fcs = net_buf_simple_pull_u8(buf);