Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble_iso): Fix null dereference may happened during BIG/CIG creation

Browse Source
This commit is contained in:
Liu Linyan
2026-07-01 11:59:45 +08:00
parent 5aa4edacdb
commit ec4aa2fa75
1 changed files with 55 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
components/bt/esp_ble_iso/host/iso/iso.c
View File

@@ -1656,10 +1656,27 @@ static bool is_advanced_cig_param(const struct bt_iso_cig_param *param)
return true;
}
/* This probe runs before valid_cig_param(); guard structure here so
* caller misuse (NULL cis_channels/cis/qos, or an over-reported num_cis)
* falls through to that check's -EINVAL instead of a NULL or
* out-of-bounds deref in this probe.
*/
if (param->cis_channels == NULL ||
param->num_cis > BT_ISO_MAX_GROUP_ISO_COUNT ||
param->num_cis > CONFIG_BT_ISO_MAX_CHAN) {
return false;
}
/* Check if any of the CIS contain any test-param-only values */
for (uint8_t i = 0U; i < param->num_cis; i++) {
const struct bt_iso_chan *cis = param->cis_channels[i];
const struct bt_iso_chan_qos *qos = cis->qos;
const struct bt_iso_chan_qos *qos;
if (cis == NULL || cis->qos == NULL) {
continue;
}
qos = cis->qos;
if (qos->num_subevents > 0U) {
return true;
@@ -1785,6 +1802,14 @@ static bool valid_cig_param(const struct bt_iso_cig_param *param, bool advanced,
return false;
}
/* Not guaranteed by all callers (bt_iso_cig_reconfigure does not pre-check
* it); the per-CIS loop below dereferences cis_channels[i] directly.
*/
if (param->cis_channels == NULL) {
LOG_ERR("CisChansNull");
return false;
}
if (param->num_cis > BT_ISO_MAX_GROUP_ISO_COUNT ||
param->num_cis > CONFIG_BT_ISO_MAX_CHAN) {
LOG_ERR("TooLargeNumCis[%u][%u]",
@@ -2659,17 +2684,32 @@ static bool is_advanced_big_param(const struct bt_iso_big_create_param *param)
return true;
}
/* This probe runs before valid_big_param(); guard structure here so
* caller misuse (NULL bis_channels/bis/qos/qos->tx, or an over-reported
* num_bis) falls through to that check's -EINVAL instead of a NULL or
* out-of-bounds deref in this probe.
*/
if (param->bis_channels == NULL ||
param->num_bis > BT_ISO_MAX_GROUP_ISO_COUNT ||
param->num_bis > CONFIG_BT_ISO_MAX_CHAN) {
return false;
}
/* Check if any of the CIS contain any test-param-only values */
for (uint8_t i = 0U; i < param->num_bis; i++) {
const struct bt_iso_chan *bis = param->bis_channels[i];
const struct bt_iso_chan_qos *qos = bis->qos;
const struct bt_iso_chan_qos *qos;
if (bis == NULL || bis->qos == NULL || bis->qos->tx == NULL) {
continue;
}
qos = bis->qos;
if (qos->num_subevents > 0U) {
return true;
}
assert(qos->tx != NULL && "BigWithNullTx");
if (qos->tx->max_pdu > 0U || qos->tx->burst_number > 0U) {
return true;
}
@@ -2693,6 +2733,17 @@ static bool valid_big_param(const struct bt_iso_big_create_param *param, bool ad
return false;
}
/* Bound num_bis before the per-BIS loop so a caller that over-reports it
* cannot drive the loop past the bis_channels[] array.
*/
CHECKIF(param->num_bis > BT_ISO_MAX_GROUP_ISO_COUNT ||
param->num_bis > CONFIG_BT_ISO_MAX_CHAN) {
LOG_ERR("TooLargeNumBis[%u][%u][%u]",
param->num_bis, BT_ISO_MAX_GROUP_ISO_COUNT, CONFIG_BT_ISO_MAX_CHAN);
return false;
}
for (uint8_t i = 0; i < param->num_bis; i++) {
struct bt_iso_chan *bis = param->bis_channels[i];
@@ -2736,14 +2787,6 @@ static bool valid_big_param(const struct bt_iso_big_create_param *param, bool ad
return false;
}
CHECKIF(param->num_bis > BT_ISO_MAX_GROUP_ISO_COUNT ||
param->num_bis > CONFIG_BT_ISO_MAX_CHAN) {
LOG_ERR("TooLargeNumBis[%u][%u]",
param->num_bis, MAX(CONFIG_BT_ISO_MAX_CHAN, BT_ISO_MAX_GROUP_ISO_COUNT));
return false;
}
CHECKIF(!IN_RANGE(param->interval, BT_ISO_SDU_INTERVAL_MIN, BT_ISO_SDU_INTERVAL_MAX)) {
LOG_ERR("InvInterval[%u]", param->interval);