espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-11-09 05:50:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/ans: Fix out of bounds access

Browse Source 
cat_id is used as index to access ble_svc_ans_new_alert_cnt and
ble_svc_ans_unr_alert_cnt and shall be validated before doing so.

X-Original-Commit: 5d8dbaf5e22c9f6cbf2370a03410a0cef0fca83a
This commit is contained in:
Szymon Janc
2017-08-18 14:12:36 +02:00
parent 947a8ab17d
commit 2b5468af44
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/services/ans/src/ble_svc_ans.c
+3 -1
View File
@@ -221,13 +221,15 @@ ble_svc_ans_access(uint16_t conn_handle, uint16_t attr_handle,
cmd_id = ble_svc_ans_alert_not_ctrl_pt[0];
cat_id = ble_svc_ans_alert_not_ctrl_pt[1];
/* Set cat_bit_mask to the appropriate bitmask based on cat_id */
if (cat_id < BLE_SVC_ANS_CAT_NUM) {
cat_bit_mask = (1 << cat_id);
} else if (cat_id == 0xff) {
cat_bit_mask = cat_id;
} else {
cat_bit_mask = 0;
/* invalid category ID */
return BLE_ATT_ERR_UNLIKELY;
}
switch (cmd_id) {