From 1724135b910b9da76ddb3066f668d192a9b47e7e Mon Sep 17 00:00:00 2001 From: Andrzej Kaczmarek Date: Mon, 25 Sep 2017 00:25:27 +0200 Subject: [PATCH] nimble/ll: Drop packets with empty payload for LL Control PDU Only continuation/empty LL Data PDU can have empty payload. Reference: Core v5.0, Vol 6, Part B, section 2.4 X-Original-Commit: dfa5d749cc1f9573e375589abbce00a906b8b8c1 --- nimble/controller/src/ble_ll_conn.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c index 86a82581a..40c29ddf8 100644 --- a/nimble/controller/src/ble_ll_conn.c +++ b/nimble/controller/src/ble_ll_conn.c @@ -3442,9 +3442,12 @@ ble_ll_conn_rx_data_pdu(struct os_mbuf *rxpdu, struct ble_mbuf_hdr *hdr) acl_len = rxbuf[1]; acl_hdr = hdr_byte & BLE_LL_DATA_HDR_LLID_MASK; - /* Check that the LLID is reasonable */ + /* + * Check that the LLID and payload length are reasonable. + * Empty payload is only allowed for LLID == 01b. + * */ if ((acl_hdr == 0) || - ((acl_hdr == BLE_LL_LLID_DATA_START) && (acl_len == 0))) { + ((acl_len == 0) && (acl_hdr != BLE_LL_LLID_DATA_FRAG))) { STATS_INC(ble_ll_conn_stats, rx_bad_llid); goto conn_rx_data_pdu_end; }