From d8106042fadba152115bd97be715b41950e57ad0 Mon Sep 17 00:00:00 2001
From: Szymon Janc <szymon.janc@codecoup.pl>
Date: Mon, 30 Jun 2025 15:31:04 +0200
Subject: [PATCH] nimble/transport: Skip H4 event parsing if received event is
 too big

If received HCI event is too big to handle just return error and
stop parsing instead of overwriting data in memeory.
---
 nimble/transport/common/hci_h4/src/hci_h4.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nimble/transport/common/hci_h4/src/hci_h4.c b/nimble/transport/common/hci_h4/src/hci_h4.c
index b81b6da27..6e7f0fb9f 100644
--- a/nimble/transport/common/hci_h4/src/hci_h4.c
+++ b/nimble/transport/common/hci_h4/src/hci_h4.c
@@ -164,6 +164,9 @@ hci_h4_sm_w4_header(struct hci_h4_sm *h4sm, struct hci_h4_input_buffer *ib)
         }
 
         h4sm->exp_len = h4sm->hdr[1] + 2;
+        if (h4sm->exp_len > MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE)) {
+            return -1;
+        }
         break;
     case HCI_H4_ISO:
         assert(h4sm->allocs && h4sm->allocs->iso);