espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-08-20 08:50:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/ll: Fix parsing length in advertising PDU

Browse Source 
In Bluetooth 5.0 length field is 8 bits so we should not use mask
anymore as it may lead to data truncation/corruption. RFU bits shall be
set to 0 by older devices to this should be safe (in earlier versions
length field was 6 bits and 2 msb were RFU).

X-Original-Commit: 7c0ceed998a82d7271b2ddfa4f1bf7b9783835d7
This commit is contained in:
Andrzej Kaczmarek
2018-02-07 11:05:18 +01:00
parent 2f3c674d01
commit 5810f86a1a
4 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/controller/include/controller/ble_ll.h
-1
View File
@@ -259,7 +259,6 @@ struct ble_dev_addr
#define BLE_ADV_PDU_HDR_CHSEL_MASK (0x20)
#define BLE_ADV_PDU_HDR_TXADD_MASK (0x40)
#define BLE_ADV_PDU_HDR_RXADD_MASK (0x80)
#define BLE_ADV_PDU_HDR_LEN_MASK (0x3F)
/* Advertising channel PDU types */
#define BLE_ADV_PDU_TYPE_ADV_IND (0)
nimble/controller/src/ble_ll.c
+1 -1
View File
@@ -935,7 +935,7 @@ ble_ll_rx_end(uint8_t *rxbuf, struct ble_mbuf_hdr *rxhdr)
/* Get advertising PDU type and length */
pdu_type = rxbuf[0] & BLE_ADV_PDU_HDR_TYPE_MASK;
len = rxbuf[1] & BLE_ADV_PDU_HDR_LEN_MASK;
len = rxbuf[1];
/* If the CRC checks, make sure lengths check! */
badpkt = 0;
nimble/controller/src/ble_ll_conn.c
+1 -1
View File
@@ -3107,7 +3107,7 @@ ble_ll_init_rx_isr_end(uint8_t *rxbuf, uint8_t crcok,
rc = -1;
pdu_type = rxbuf[0] & BLE_ADV_PDU_HDR_TYPE_MASK;
pyld_len = rxbuf[1] & BLE_ADV_PDU_HDR_LEN_MASK;
pyld_len = rxbuf[1];
if (!crcok) {
#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
nimble/controller/src/ble_ll_scan.c
+1 -1
View File
@@ -745,7 +745,7 @@ ble_ll_scan_send_adv_report(uint8_t pdu_type, uint8_t txadd, struct os_mbuf *om,
} else {
evtype = BLE_HCI_ADV_RPT_EVTYPE_SCAN_RSP;
}
adv_data_len = rxbuf[1] & BLE_ADV_PDU_HDR_LEN_MASK;
adv_data_len = rxbuf[1];
adv_data_len -= BLE_DEV_ADDR_LEN;
event_len = BLE_HCI_LE_ADV_RPT_MIN_LEN + adv_data_len;
os_mbuf_adj(om, BLE_LL_PDU_HDR_LEN + BLE_DEV_ADDR_LEN);