Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge branch 'bugfix/blufi_buffer_overflow_report_v3.3' into 'release/v3.3'

Browse source 
blufi: When the format of the received data packet is wrong, reply with an error response(backport 3.3)

See merge request espressif/esp-idf!9198
This commit is contained in:
Island 2020-06-18 13:45:34 +08:00
parent 2aaf254d44 563c9901ca
commit 2ea53169ad
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
components/bt/bluedroid/api/include/api/esp_blufi_api.h
View file

@ -83,6 +83,7 @@ typedef enum {
ESP_BLUFI_DH_PARAM_ERROR,
ESP_BLUFI_READ_PARAM_ERROR,
ESP_BLUFI_MAKE_PUBLIC_ERROR,
ESP_BLUFI_DATA_FORMAT_ERROR,
} esp_blufi_error_state_t;
/**

12
components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
View file

@ -429,11 +429,19 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
if (blufi_env.aggr_buf == NULL) {
BTC_TRACE_ERROR("%s no mem, len %d\n", __func__, blufi_env.total_len);
btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
return;
}
}
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len - 2);
blufi_env.offset += (hdr->data_len - 2);
if (blufi_env.offset + hdr->data_len - 2 <= blufi_env.total_len){
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len - 2);
blufi_env.offset += (hdr->data_len - 2);
} else {
BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
return;
}
} else {
if (blufi_env.offset > 0) { /* if previous pkt is frag */
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);