From 5810f86a1a9916d90d2f33f0e423a29b99cbf488 Mon Sep 17 00:00:00 2001 From: Andrzej Kaczmarek Date: Tue, 6 Feb 2018 19:26:33 +0100 Subject: [PATCH] nimble/ll: Fix parsing length in advertising PDU In Bluetooth 5.0 length field is 8 bits so we should not use mask anymore as it may lead to data truncation/corruption. RFU bits shall be set to 0 by older devices to this should be safe (in earlier versions length field was 6 bits and 2 msb were RFU). X-Original-Commit: 7c0ceed998a82d7271b2ddfa4f1bf7b9783835d7 --- nimble/controller/include/controller/ble_ll.h | 1 - nimble/controller/src/ble_ll.c | 2 +- nimble/controller/src/ble_ll_conn.c | 2 +- nimble/controller/src/ble_ll_scan.c | 2 +- 4 files changed, 3 insertions(+), 4 deletions(-) diff --git a/nimble/controller/include/controller/ble_ll.h b/nimble/controller/include/controller/ble_ll.h index 97338dc68..f8a85fd66 100644 --- a/nimble/controller/include/controller/ble_ll.h +++ b/nimble/controller/include/controller/ble_ll.h @@ -259,7 +259,6 @@ struct ble_dev_addr #define BLE_ADV_PDU_HDR_CHSEL_MASK (0x20) #define BLE_ADV_PDU_HDR_TXADD_MASK (0x40) #define BLE_ADV_PDU_HDR_RXADD_MASK (0x80) -#define BLE_ADV_PDU_HDR_LEN_MASK (0x3F) /* Advertising channel PDU types */ #define BLE_ADV_PDU_TYPE_ADV_IND (0) diff --git a/nimble/controller/src/ble_ll.c b/nimble/controller/src/ble_ll.c index 649a59cc8..23d8d78de 100644 --- a/nimble/controller/src/ble_ll.c +++ b/nimble/controller/src/ble_ll.c @@ -935,7 +935,7 @@ ble_ll_rx_end(uint8_t *rxbuf, struct ble_mbuf_hdr *rxhdr) /* Get advertising PDU type and length */ pdu_type = rxbuf[0] & BLE_ADV_PDU_HDR_TYPE_MASK; - len = rxbuf[1] & BLE_ADV_PDU_HDR_LEN_MASK; + len = rxbuf[1]; /* If the CRC checks, make sure lengths check! */ badpkt = 0; diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c index 4c93391cd..d4d95566e 100644 --- a/nimble/controller/src/ble_ll_conn.c +++ b/nimble/controller/src/ble_ll_conn.c @@ -3107,7 +3107,7 @@ ble_ll_init_rx_isr_end(uint8_t *rxbuf, uint8_t crcok, rc = -1; pdu_type = rxbuf[0] & BLE_ADV_PDU_HDR_TYPE_MASK; - pyld_len = rxbuf[1] & BLE_ADV_PDU_HDR_LEN_MASK; + pyld_len = rxbuf[1]; if (!crcok) { #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV) diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c index f1935d2c1..c58fe2120 100644 --- a/nimble/controller/src/ble_ll_scan.c +++ b/nimble/controller/src/ble_ll_scan.c @@ -745,7 +745,7 @@ ble_ll_scan_send_adv_report(uint8_t pdu_type, uint8_t txadd, struct os_mbuf *om, } else { evtype = BLE_HCI_ADV_RPT_EVTYPE_SCAN_RSP; } - adv_data_len = rxbuf[1] & BLE_ADV_PDU_HDR_LEN_MASK; + adv_data_len = rxbuf[1]; adv_data_len -= BLE_DEV_ADDR_LEN; event_len = BLE_HCI_LE_ADV_RPT_MIN_LEN + adv_data_len; os_mbuf_adj(om, BLE_LL_PDU_HDR_LEN + BLE_DEV_ADDR_LEN);