Rahul Tank eed4636870 fix(nimble): Address security vulnerabilties and NVS corruption issues. ...

Security Issues Fixed:

1. Buffer Overflow Prevention (ble_store_nvs.c)
- Changed all sprintf() calls to snprintf() in get_nvs_key_string()
  to prevent potential buffer overflow when generating NVS key strings
- Changed index parameter type from int8_t to int in ble_nvs_delete_value()
  to handle values > 127 correctly

2. Bounds Checking (ble_store_nvs.c)
- Added bounds checking in populate_db_from_nvs() before each memcpy
  operation to prevent buffer overflow when NVS contains more entries
  than RAM arrays can hold (due to config mismatch or NVS corruption)

3. Array Index Validation (ble_store_nvs.c)
- Fixed potential array index -1 access in ble_nvs_restore_sec_keys()
  by adding checks before accessing [num - 1] indices
- Fixed loop bounds to use actual populated count instead of max config value

4. NVS Data Size Validation (ble_store_nvs.c)
- Added get_expected_size_for_obj_type() helper function
- Added size validation in get_nvs_db_value() and get_nvs_peer_record()
  to detect corrupted or version-mismatched NVS data before reading

5. Type Safety Fix (ble_store_config_conf.c)
- Fixed critical typo: && to & for ble_store_config_num_csfcs
- Added missing union members (csfc, ead) in ble_store_config_conf_export()

6. Thread Safety (ble_gattc_cache.c)
- Replaced static buffer with thread-local storage (__thread) in getKeyname()
- Changed sprintf() to snprintf() with explicit size limit
- Increased buffer size from 16 to 20 bytes for safety margin

2026-02-03 12:35:05 +05:30

..

config

fix(nimble): Address security vulnerabilties and NVS corruption issues.

2026-02-03 12:35:05 +05:30

ram

fix(nimble): Add support for minimilistic build sdkconfig

2025-05-19 12:41:40 +05:30