From 05358e6dd078013da07fbeda182e0d952e3d3103 Mon Sep 17 00:00:00 2001 From: Chongqing Lei Date: Thu, 10 Apr 2025 20:21:40 +0200 Subject: [PATCH] wireless/bt_hcicore: Fix H4 header and data buffer length verification. Driver now validates data and H4 header length against CONFIG_IOB_BUFSIZE. Signed-off-by: Tomasz 'CeDeROM' CEDRO --- wireless/bluetooth/bt_hcicore.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/wireless/bluetooth/bt_hcicore.c b/wireless/bluetooth/bt_hcicore.c index a993073d822..98b02e61d30 100644 --- a/wireless/bluetooth/bt_hcicore.c +++ b/wireless/bluetooth/bt_hcicore.c @@ -1802,6 +1802,12 @@ int bt_receive(FAR struct bt_driver_s *btdev, enum bt_buf_type_e type, struct bt_buf_s *buf; int ret; + if (len + BLUETOOTH_H4_HDRLEN > CONFIG_IOB_BUFSIZE) + { + wlerr("ERROR: Data too long\n"); + return -EINVAL; + } + wlinfo("data %p len %zu\n", data, len); /* Critical command complete/status events use the high priority work