From fce3fa337af6653febb055cb41d1a75b7d7098ef Mon Sep 17 00:00:00 2001 From: zhanghaipeng Date: Wed, 27 May 2026 20:40:51 +0800 Subject: [PATCH] fix(ble/bluedroid): Validate signed-write perm vs AUTH in attr table check --- .../host/bluedroid/btc/profile/std/gatt/btc_gatts.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c index 6f9f50d3bd4..8594a490574 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c +++ b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c @@ -560,6 +560,19 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat return ESP_GATT_INVALID_PDU; } } + + /* Same rule as GATTS_AddCharacteristic(): signed-write perm requires AUTH property */ + { + uint8_t char_property = (uint8_t)(*(uint8_t *)(gatts_attr_db[i].att_desc.value)); + uint16_t perm = gatts_attr_db[i + 1].att_desc.perm; + + if (((char_property & GATT_CHAR_PROP_BIT_AUTH) && !(perm & GATT_WRITE_SIGNED_PERM)) || + ((perm & GATT_WRITE_SIGNED_PERM) && !(char_property & GATT_CHAR_PROP_BIT_AUTH))) { + BTC_TRACE_ERROR("%s, Invalid char property=0x%02x perm=0x%04x at table index %d", + __func__, char_property, perm, i); + return ESP_GATT_ILLEGAL_PARAMETER; + } + } break; default: break;