espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-08-10 03:57:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

host/l2cap: disconnect if received packet is larger than MPS

Browse Source 
Peer sending packet larger than MPS is invalid, and should be met
with L2CAP channel disconnection.

This affects L2CAP/LE/CFC/BV-27-C
This commit is contained in:
Krzysztof Kopyściński
2022-04-13 12:00:40 +02:00
committed by Szymon Janc
parent f2f24ad5a5
commit 09466ab810
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/src/ble_l2cap.c
+10
View File
@@ -388,6 +388,16 @@ ble_l2cap_rx(struct ble_hs_conn *conn,
goto err;
}
/* For CIDs from dynamic range we check if SDU size isn't larger than MPS */
if (chan->dcid >= 0x0040 && chan->dcid <= 0x007F && l2cap_hdr.len > chan->my_coc_mps) {
/* Data exceeds MPS */
BLE_HS_LOG(ERROR, "error: sdu_len > chan->my_coc_mps (%d>%d)\n",
l2cap_hdr.len, chan->my_coc_mps);
ble_l2cap_disconnect(chan);
rc = BLE_HS_EBADDATA;
goto err;
}
if (chan->rx_buf != NULL) {
/* Previous data packet never completed. Discard old packet. */
ble_l2cap_remove_rx(conn, chan);