espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-10-02 10:00:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/ble_enhanced_security_v2' into 'master'

Browse Source 
fix(ble/bluedroid): Fixed potential out-of-bounds memory access when resolve adv data

Closes BLERP-2149

See merge request espressif/esp-idf!41160
This commit is contained in:
Island
2025-08-14 17:28:13 +08:00
parent 7a6559f7d5 6b360dacf6
commit c6923d2a26
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
View File

@@ -2071,6 +2071,13 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT16 adv_data_len, UINT8 type, UINT8 *p
STREAM_TO_UINT8(adv_type, p); STREAM_TO_UINT8(adv_type, p);
if ( adv_type == type ) { if ( adv_type == type ) {
if((p + length - 1) > (p_adv + adv_data_len)) {
/* avoid memory overflow*/
*p_length = 0;
return NULL;
}
/* length doesn't include itself */ /* length doesn't include itself */
*p_length = length - 1; /* minus the length of type */ *p_length = length - 1; /* minus the length of type */
return p; return p;

2
examples/bluetooth/bluedroid/ble/gatt_server/main/gatts_demo.c
View File

@@ -204,7 +204,7 @@ void example_exec_write_event_env(prepare_type_env_t *prepare_write_env, esp_ble
static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param)
{ {
switch (event) { switch (event) {
#ifdef CONFIG_SET_RAW_ADV_DATA #ifdef CONFIG_EXAMPLE_SET_RAW_ADV_DATA
case ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT: case ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT:
adv_config_done &= (~adv_config_flag); adv_config_done &= (~adv_config_flag);
if (adv_config_done==0){ if (adv_config_done==0){

1
examples/bluetooth/bluedroid/ble/gatt_server_service_table/tutorial/Gatt_Server_Service_Table_Example_Walkthrough.md
View File

@@ -26,7 +26,6 @@ Let’s start by taking a look at the included headers in the [gatts_table_creat
#include "esp_gatts_api.h" #include "esp_gatts_api.h"
#include "esp_bt_defs.h" #include "esp_bt_defs.h"
#include "esp_bt_main.h" #include "esp_bt_main.h"
#include "esp_bt_main.h"
#include “gatts_table_creat_demo.h" #include “gatts_table_creat_demo.h"
``` ```
These includes are required for the *FreeRTOS* and underlying system components to run, including logging functionality and a library to store data in non-volatile flash memory. We are interested in ``bt.h``, ``esp_bt_main.h``, ``esp_gap_ble_api.h`` and ``esp_gatts_api.h`` which expose the BLE APIs required to implement this example. These includes are required for the *FreeRTOS* and underlying system components to run, including logging functionality and a library to store data in non-volatile flash memory. We are interested in ``bt.h``, ``esp_bt_main.h``, ``esp_gap_ble_api.h`` and ``esp_gatts_api.h`` which expose the BLE APIs required to implement this example.