luchianmihai/walnux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wireless/bt_hcicore: Fix H4 header and data buffer length verification.

Browse source 
Driver now validates data and H4 header length against CONFIG_IOB_BUFSIZE.

Signed-off-by: Tomasz 'CeDeROM' CEDRO <tomek@cedro.info>
This commit is contained in:
Chongqing Lei 2025-04-10 20:21:40 +02:00 • committed by Xiang Xiao
parent 08c239dcd1
commit 05358e6dd0
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
wireless/bluetooth/bt_hcicore.c
View file

@ -1802,6 +1802,12 @@ int bt_receive(FAR struct bt_driver_s *btdev, enum bt_buf_type_e type,
struct bt_buf_s *buf;
int ret;
if (len + BLUETOOTH_H4_HDRLEN > CONFIG_IOB_BUFSIZE)
{
wlerr("ERROR: Data too long\n");
return -EINVAL;
}
wlinfo("data %p len %zu\n", data, len);
/* Critical command complete/status events use the high priority work