feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

Merge branch 'bugfix/fix_bluedroid_host_memory_overflow_v4.4' into 'release/v4.4'

Browse Source 
Fixed bluedroid host memory overflow for v4.4

See merge request espressif/esp-idf!18903
This commit is contained in:
Jiang Jiang Jian
2022-07-07 10:54:08 +08:00
parent d949df8dcb 363b8b2973
commit eaf6f3c2cd
2 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
components/bt/host/bluedroid/stack/gatt/gatt_api.c
View File

@@ -583,6 +583,11 @@ tGATT_STATUS GATTS_HandleValueIndication (UINT16 conn_id, UINT16 attr_handle, U
return (tGATT_STATUS) GATT_INVALID_CONN_ID;
}
if ((GATT_CH_OPEN != gatt_get_ch_state(p_tcb)) || (p_tcb->payload_size == 0)) {
GATT_TRACE_ERROR("connection not established\n");
return GATT_WRONG_STATE;
}
if (! GATT_HANDLE_IS_VALID (attr_handle)) {
return GATT_ILLEGAL_PARAMETER;
}
@@ -650,6 +655,11 @@ tGATT_STATUS GATTS_HandleValueNotification (UINT16 conn_id, UINT16 attr_handle,
return (tGATT_STATUS) GATT_INVALID_CONN_ID;
}
if ((GATT_CH_OPEN != gatt_get_ch_state(p_tcb)) || (p_tcb->payload_size == 0)) {
GATT_TRACE_ERROR("connection not established\n");
return GATT_WRONG_STATE;
}
if (GATT_HANDLE_IS_VALID (attr_handle)) {
notif.handle = attr_handle;
notif.len = val_len;

7
components/bt/host/bluedroid/stack/l2cap/l2c_api.c
View File

@@ -2329,6 +2329,13 @@ void l2ble_update_att_acl_pkt_num(UINT8 type, tl2c_buff_param_t *param)
xSemaphoreGive(buff_semaphore);
break;
}
if ((GATT_CH_OPEN != gatt_get_ch_state(p_tcb)) || (p_tcb->payload_size == 0)) {
L2CAP_TRACE_ERROR("connection not established\n");
xSemaphoreGive(buff_semaphore);
break;
}
tL2C_LCB * p_lcb = l2cu_find_lcb_by_bd_addr (p_tcb->peer_bda, BT_TRANSPORT_LE);
if (p_lcb == NULL){
L2CAP_TRACE_ERROR("%s not found p_lcb", __func__);