Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge branch 'bugfix/blufi_buffer_overflow_report_v4.1' into 'release/v4.1'

Browse source 
Bugfix/blufi buffer overflow report v4.1

See merge request espressif/esp-idf!9178
This commit is contained in:
Jiang Jiang Jian 2020-06-16 15:59:49 +08:00
parent f82010fa6a ae64d9e738
commit 5e52e5f6f5
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
components/bt/host/bluedroid/api/include/api/esp_blufi_api.h
View file

@ -83,6 +83,7 @@ typedef enum {
ESP_BLUFI_DH_PARAM_ERROR,
ESP_BLUFI_READ_PARAM_ERROR,
ESP_BLUFI_MAKE_PUBLIC_ERROR,
ESP_BLUFI_DATA_FORMAT_ERROR,
} esp_blufi_error_state_t;
/**

12
components/bt/host/bluedroid/btc/profile/esp/blufi/blufi_prf.c
View file

@ -433,11 +433,19 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
if (blufi_env.aggr_buf == NULL) {
BTC_TRACE_ERROR("%s no mem, len %d\n", __func__, blufi_env.total_len);
btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
return;
}
}
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len - 2);
blufi_env.offset += (hdr->data_len - 2);
if (blufi_env.offset + hdr->data_len - 2 <= blufi_env.total_len){
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len - 2);
blufi_env.offset += (hdr->data_len - 2);
} else {
BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
return;
}
} else {
if (blufi_env.offset > 0) { /* if previous pkt is frag */
memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);