espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-30 02:37:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

ble_mesh: Add length check for some mesh operations

Browse Source
This commit is contained in:
lly
2020-04-01 20:02:10 +08:00
committed by baohongde
parent 1a89bfaef3
commit 0c5d5c9dd6
6 changed files with 31 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c
View File

@ -44,6 +44,9 @@ uint16_t *esp_ble_mesh_is_model_subscribed_to_group(esp_ble_mesh_model_t *model,
esp_ble_mesh_elem_t *esp_ble_mesh_find_element(uint16_t element_addr)
{
if (!ESP_BLE_MESH_ADDR_IS_UNICAST(element_addr)) {
return NULL;
}
return btc_ble_mesh_elem_find(element_addr);
}

7
components/bt/esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c
View File

@ -350,6 +350,10 @@ esp_err_t esp_ble_mesh_provisioner_set_dev_uuid_match(const uint8_t *match_val,
btc_ble_mesh_prov_args_t arg = {0};
btc_msg_t msg = {0};
if (match_len + offset > ESP_BLE_MESH_OCTET16_LEN) {
return ESP_ERR_INVALID_ARG;
}
ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
@ -446,7 +450,8 @@ esp_err_t esp_ble_mesh_set_fast_prov_info(esp_ble_mesh_fast_prov_info_t *fast_pr
btc_ble_mesh_prov_args_t arg = {0};
btc_msg_t msg = {0};
if (fast_prov_info == NULL) {
if (fast_prov_info == NULL || (fast_prov_info->offset +
fast_prov_info->match_len > ESP_BLE_MESH_OCTET16_LEN)) {
return ESP_ERR_INVALID_ARG;
}

6
components/bt/esp_ble_mesh/mesh_core/prov.c
View File

@ -1743,6 +1743,12 @@ int bt_mesh_prov_init(const struct bt_mesh_prov *prov_info)
return -EINVAL;
}
if (prov_info->static_val_len > 16 ||
prov_info->output_size > 8 || prov_info->input_size > 8) {
BT_ERR("%s, Invalid auth oob length", __func__);
return -EINVAL;
}
/* Changed by Espressif. Use micro-ecc to generate public key now. */
key = bt_mesh_pub_key_get();
if (!key) {

5
components/bt/esp_ble_mesh/mesh_core/provisioner_prov.c
View File

@ -2163,6 +2163,11 @@ int bt_mesh_provisioner_set_oob_output_data(const u8_t idx, const u8_t *num, u8_
* Parameter num_flag is used to indicate whether the value
* output by provisioner is number or string.
*/
if (num == NULL || size > 8) {
BT_ERR("%s, Invalid parameter", __func__);
return -EINVAL;
}
if (!link[idx].auth) {
BT_ERR("%s, link auth is NULL", __func__);
return -EINVAL;

5
components/bt/esp_ble_mesh/mesh_core/proxy_client.c
View File

@ -660,6 +660,11 @@ void bt_mesh_proxy_client_adv_ind_recv(struct net_buf_simple *buf, const bt_mesh
switch (type) {
case BLE_MESH_PROXY_ADV_NET_ID: {
if (buf->len != sizeof(ctx.net_id.net_id)) {
BT_WARN("Malformed Network ID");
return;
}
struct bt_mesh_subnet *sub = NULL;
sub = bt_mesh_is_net_id_exist(buf->data);
if (!sub) {

15
examples/bluetooth/esp_ble_mesh/ble_mesh_vendor_models/fast_prov_vendor_model/components/esp_fast_prov_server_model.c
View File

@ -139,7 +139,7 @@ esp_err_t example_fast_prov_server_recv_msg(esp_ble_mesh_model_t *model,
* status_bit_mask (2) + status_ctx_flag (1) + status_unicast (1) + status_net_idx (1) +
* status_group (1) + status_pri_prov (1) + status_match (1) + status_action (1).
*/
uint8_t match_len = 0, match_val[16];
uint8_t match_len = 0, match_val[16] = {0};
uint8_t status_unicast = 0;
uint8_t flags = 0;
@ -186,6 +186,11 @@ esp_err_t example_fast_prov_server_recv_msg(esp_ble_mesh_model_t *model,
uint16_t pri_prov_addr = (ctx_flags & BIT(7)) ? net_buf_simple_pull_le16(buf) : ESP_BLE_MESH_ADDR_UNASSIGNED;
if (ctx_flags & BIT(8)) {
match_len = buf->len - ((ctx_flags & BIT(9)) ? 1 : 0);
if (match_len > ESP_BLE_MESH_OCTET16_LEN) {
net_buf_simple_add_le16(msg, BIT(5));
net_buf_simple_add_u8(msg, 0x01); /* too large match value length */
break;
}
memcpy(match_val, buf->data, match_len);
net_buf_simple_pull(buf, match_len);
}
@ -249,14 +254,6 @@ esp_err_t example_fast_prov_server_recv_msg(esp_ble_mesh_model_t *model,
}
}
if (ctx_flags & BIT(8)) {
if (match_len > 16) {
net_buf_simple_add_le16(msg, BIT(5));
net_buf_simple_add_u8(msg, 0x01); /* too large match value length */
break;
}
}
if (ctx_flags & BIT(9)) {
if ((action & BIT_MASK(2)) != FAST_PROV_ACT_ENTER) {
net_buf_simple_add_le16(msg, BIT(6));