mirror of
https://github.com/apache/nuttx.git
synced 2026-09-30 19:06:22 +00:00
c728586a48
hci_event() consumed the event header and dispatched on the event code without checking that a header had been received, and hci_le_meta_event() did the same for the subevent code. Each handler then cast the remaining buffer to its event structure and read fields out of it, so a short event was parsed from whatever followed it in memory - including the fields that identify a connection and carry its encryption state. Check that the header is present before reading it, that the parameters the event declares were actually received, and that enough parameters remain for the structure the selected handler casts to. Events failing a check are dropped with a diagnostic rather than parsed. le_adv_report() continues to do its own checking, because the report count and the per-report lengths vary within that event. Ref: Core v6.0, Vol 4, Part E, 5.4.4 (HCI Event packets) Ref: Core v6.0, Vol 4, Part E, 7.7 (Events) Testing: builds for sim:bluetooth with Make; every commit in this series verified to build individually. Not yet exercised at runtime - the scriptable controller injects truncated events separately. Signed-off-by: Alan C. Assis <acassis@gmail.com> Assisted-by: Claude Code Opus 5 |
||
|---|---|---|
| .. | ||
| bt_atomic.h | ||
| bt_att.c | ||
| bt_att.h | ||
| bt_buf.c | ||
| bt_buf.h | ||
| bt_conn.c | ||
| bt_conn.h | ||
| bt_gatt.c | ||
| bt_hcicore.c | ||
| bt_hcicore.h | ||
| bt_ioctl.c | ||
| bt_ioctl.h | ||
| bt_keys.c | ||
| bt_keys.h | ||
| bt_l2cap.c | ||
| bt_l2cap.h | ||
| bt_netdev.c | ||
| bt_queue.c | ||
| bt_queue.h | ||
| bt_services.c | ||
| bt_smp.c | ||
| bt_smp.h | ||
| bt_uuid.c | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Make.defs | ||