kopia lustrzana https://github.com/espressif/esp-idf
Merge branch 'bugfix/ble_check_adv_data_v4.4' into 'release/v4.4'
fix(bt/bluedroid): Fix ble adv data check to avoid memory overflow(backport v4.4) See merge request espressif/esp-idf!28408pull/13426/head
commit
9186e0e22d
|
@ -2090,7 +2090,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
|
|||
|
||||
STREAM_TO_UINT8(length, p);
|
||||
|
||||
while ( length && (p - p_adv <= BTM_BLE_CACHE_ADV_DATA_MAX)) {
|
||||
while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
|
||||
STREAM_TO_UINT8(adv_type, p);
|
||||
|
||||
if ( adv_type == type ) {
|
||||
|
@ -2098,7 +2098,15 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
|
|||
*p_length = length - 1; /* minus the length of type */
|
||||
return p;
|
||||
}
|
||||
|
||||
p += length - 1; /* skip the length of data */
|
||||
|
||||
/* Break loop if advertising data is in an incorrect format,
|
||||
as it may lead to memory overflow */
|
||||
if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
|
||||
break;
|
||||
}
|
||||
|
||||
STREAM_TO_UINT8(length, p);
|
||||
}
|
||||
|
||||
|
|
Ładowanie…
Reference in New Issue