espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-08-03 08:37:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

host/ble_l2cap_coc: coc_rx.sdus index should not exceed BLE_L2CAP_SDU_BUFF_CNT

Browse Source 
Multiple calls to `ble_l2cap_coc_recv_ready` with
`BLE_L2CAP_SDU_BUFF_CNT == 1` will lead to assigning coc_rx.sdus outside
array range - so this will (most likely) overwrite rest of stucture.
This will lead to either undefined behavior or crash when structure
members are accessed.
This commit is contained in:
Krzysztof Kopyściński
2023-07-25 15:02:20 +02:00
committed by Łukasz Rymanowski
parent ef0fb14f99
commit dc60f90a37
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/src/ble_l2cap_coc.c
+6 -1
View File
@@ -341,7 +341,12 @@ ble_l2cap_coc_chan_alloc(struct ble_hs_conn *conn, uint16_t psm, uint16_t mtu,
chan->coc_rx.sdus[i] = NULL;
}
chan->coc_rx.current_sdu_idx = 0;
chan->coc_rx.next_sdu_alloc_idx = chan->coc_rx.sdus[0] == NULL ? 0 : 1;
if (BLE_L2CAP_SDU_BUFF_CNT == 1) {
chan->coc_rx.next_sdu_alloc_idx = 0;
} else {
chan->coc_rx.next_sdu_alloc_idx = chan->coc_rx.sdus[0] == NULL ? 0 : 1;
}
/* Number of credits should allow to send full SDU with on given
* L2CAP MTU