acassis opened a new pull request, #20184:
URL: https://github.com/apache/nuttx/pull/20184
## Summary
le_adv_report() took the report count and each report's data length from the
event and used them without checking either against the data that was actually
received:
- the declared data length indexes the RSSI octet, so a length larger than
the event reads past the end of the buffer;
- the loop was bounded only by the report count, so a count larger than
the payload walks off the end of it;
- bt_buf_consume() only checks its bound with DEBUGASSERT(), so on a build
without assertions the buffer length underflows rather than reporting the
problem.
Check that the event is long enough for the count, then check each report
against the remaining length before reading its data or its RSSI, and stop
parsing when a report does not fit.
While here, include the RSSI octet when advancing to the next report.
sizeof() of the report structure does not account for it, because the data
member is a zero-length array, so every report after the first started one
octet early.
Ref: Core v6.0, Vol 4, Part E, 7.7.65.2 (LE Advertising Report event)
Testing: builds for sim:bluetooth with Make; every commit in this series
verified to build individually. Not yet exercised at runtime - the scriptable
controller that can inject a malformed report is added separately.
## Impact
Improvement
## Testing
Before this change:
```
le_adv_report: Adv number of reports 2
le_adv_report: AA:AA:AA:AA:AA:01 (public) event 0, len 3, rssi -40 dBm
le_adv_report: BB:BB:BB:BB:02:00 (public) event 216, len 187, rssi 0 dBm
btnet_scan_callback: ERROR: Scan result is too big: 187
```
The second report is read one octet early because the advance did not
count the RSSI octet: its address is shifted, its event type is 216,
which is the first report's RSSI, and its length is 187, which is an
octet of its own address. That length then indexes the RSSI 187 octets
past the report. "bt bnep0 scan get" lists only the first advertiser.
After:
```
le_adv_report: AA:AA:AA:AA:AA:01 (public) event 0, len 3, rssi -40 dBm
le_adv_report: BB:BB:BB:BB:BB:02 (public) event 0, len 3, rssi -50 dBm
```
and both advertisers are listed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
