Explorar el Código

NimBLE: host_rcv_pkt event buf size check.

Check if the size of HCI event buffer is greater than the received HCI
packet. If not then abort with the error message.
Chinmay Chhajed hace 5 años
padre
commit
1aa40de934
Se han modificado 1 ficheros con 7 adiciones y 0 borrados
  1. 7 0
      components/nimble/esp-hci/src/esp_nimble_hci.c

+ 7 - 0
components/nimble/esp-hci/src/esp_nimble_hci.c

@@ -341,6 +341,13 @@ static int host_rcv_pkt(uint8_t *data, uint16_t len)
         totlen = BLE_HCI_EVENT_HDR_LEN + data[2];
         assert(totlen <= UINT8_MAX + BLE_HCI_EVENT_HDR_LEN);
 
+        if (totlen > MYNEWT_VAL(BLE_HCI_EVT_BUF_SIZE)) {
+            ESP_LOGE(TAG, "Received HCI data length at host (%d) exceeds maximum configured HCI event buffer size (%d).",
+                     totlen, MYNEWT_VAL(BLE_HCI_EVT_BUF_SIZE));
+            ble_hs_sched_reset(BLE_HS_ECONTROLLER);
+            return 0;
+        }
+
         if (data[1] == BLE_HCI_EVCODE_HW_ERROR) {
             assert(0);
         }