From 2b5468af441109bf0e4be42d7800213521dba208 Mon Sep 17 00:00:00 2001 From: Szymon Janc Date: Fri, 18 Aug 2017 14:12:36 +0200 Subject: [PATCH] nimble/ans: Fix out of bounds access cat_id is used as index to access ble_svc_ans_new_alert_cnt and ble_svc_ans_unr_alert_cnt and shall be validated before doing so. X-Original-Commit: 5d8dbaf5e22c9f6cbf2370a03410a0cef0fca83a --- nimble/host/services/ans/src/ble_svc_ans.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nimble/host/services/ans/src/ble_svc_ans.c b/nimble/host/services/ans/src/ble_svc_ans.c index 85539c9b9..2403c6dc8 100644 --- a/nimble/host/services/ans/src/ble_svc_ans.c +++ b/nimble/host/services/ans/src/ble_svc_ans.c @@ -221,13 +221,15 @@ ble_svc_ans_access(uint16_t conn_handle, uint16_t attr_handle, cmd_id = ble_svc_ans_alert_not_ctrl_pt[0]; cat_id = ble_svc_ans_alert_not_ctrl_pt[1]; + /* Set cat_bit_mask to the appropriate bitmask based on cat_id */ if (cat_id < BLE_SVC_ANS_CAT_NUM) { cat_bit_mask = (1 << cat_id); } else if (cat_id == 0xff) { cat_bit_mask = cat_id; } else { - cat_bit_mask = 0; + /* invalid category ID */ + return BLE_ATT_ERR_UNLIKELY; } switch (cmd_id) {