Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

ble_mesh: stack: Check model status with variable length

Browse source
This commit is contained in:
lly 2020-06-19 21:30:55 +08:00
parent 93aa9163c7
commit ba5da8b086
3 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
components/bt/esp_ble_mesh/mesh_models/server/generic_server.c
View file

@ -2193,6 +2193,7 @@ static void gen_client_prop_get(struct bt_mesh_model *model,
total_len += sizeof(u16_t); total_len += sizeof(u16_t);
if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) { if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) {
/* Add this in case the message is too long */ /* Add this in case the message is too long */
BT_WARN("Too large generic client properties status");
break; break;
} }
net_buf_simple_add_le16(sdu, srv->property_ids[i]); net_buf_simple_add_le16(sdu, srv->property_ids[i]);

18
components/bt/esp_ble_mesh/mesh_models/server/sensor_server.c
View file

@ -52,6 +52,7 @@ static void send_sensor_descriptor_status(struct bt_mesh_model *model,
total_len += SENSOR_DESCRIPTOR_LEN; total_len += SENSOR_DESCRIPTOR_LEN;
if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) { if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) {
/* Add this in case the message is too long */ /* Add this in case the message is too long */
BT_WARN("Too large sensor descriptor status");
break; break;
} }
net_buf_simple_add_le16(msg, state->sensor_property_id); net_buf_simple_add_le16(msg, state->sensor_property_id);
@ -67,6 +68,12 @@ static void send_sensor_descriptor_status(struct bt_mesh_model *model,
state = &srv->states[i]; state = &srv->states[i];
if (state->sensor_property_id != INVALID_SENSOR_PROPERTY_ID && if (state->sensor_property_id != INVALID_SENSOR_PROPERTY_ID &&
state->sensor_property_id == prop_id) { state->sensor_property_id == prop_id) {
total_len += SENSOR_DESCRIPTOR_LEN;
if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) {
/* Add this in case the message is too long */
BT_WARN("Too large sensor descriptor status");
break;
}
net_buf_simple_add_le16(msg, state->sensor_property_id); net_buf_simple_add_le16(msg, state->sensor_property_id);
net_buf_simple_add_le32(msg, (state->descriptor.sample_function << 24) | net_buf_simple_add_le32(msg, (state->descriptor.sample_function << 24) |
(state->descriptor.negative_tolerance << 12) | (state->descriptor.negative_tolerance << 12) |
@ -115,6 +122,7 @@ static void send_sensor_data_status(struct bt_mesh_model *model,
state->sensor_data.raw_value->len : 0)); state->sensor_data.raw_value->len : 0));
if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) { if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) {
/* Add this in case the message is too long */ /* Add this in case the message is too long */
BT_WARN("Too large sensor status");
break; break;
} }
if (state->sensor_data.format == SENSOR_DATA_FORMAT_A) { if (state->sensor_data.format == SENSOR_DATA_FORMAT_A) {
@ -136,6 +144,15 @@ static void send_sensor_data_status(struct bt_mesh_model *model,
state = &srv->states[i]; state = &srv->states[i];
if (state->sensor_property_id != INVALID_SENSOR_PROPERTY_ID && if (state->sensor_property_id != INVALID_SENSOR_PROPERTY_ID &&
state->sensor_property_id == prop_id) { state->sensor_property_id == prop_id) {
u8_t mpid_len = (state->sensor_data.format == SENSOR_DATA_FORMAT_A) ?
SENSOR_DATA_FORMAT_A_MPID_LEN : SENSOR_DATA_FORMAT_B_MPID_LEN;
total_len += (mpid_len + (state->sensor_data.raw_value ?
state->sensor_data.raw_value->len : 0));
if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) {
/* Add this in case the message is too long */
BT_WARN("Too large sensor status");
break;
}
if (state->sensor_data.format == SENSOR_DATA_FORMAT_A) { if (state->sensor_data.format == SENSOR_DATA_FORMAT_A) {
u16_t mpid = ((state->sensor_property_id & BIT_MASK(11)) << 5) | u16_t mpid = ((state->sensor_property_id & BIT_MASK(11)) << 5) |
((state->sensor_data.length & BIT_MASK(4)) << 1) | ((state->sensor_data.length & BIT_MASK(4)) << 1) |
@ -298,6 +315,7 @@ static void send_sensor_settings_status(struct bt_mesh_model *model,
total_len += SENSOR_SETTING_PROPERTY_ID_LEN; total_len += SENSOR_SETTING_PROPERTY_ID_LEN;
if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) { if (total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) {
/* Add this in case the message is too long */ /* Add this in case the message is too long */
BT_WARN("Too large sensor settings status");
break; break;
} }
net_buf_simple_add_le16(msg, item->property_id); net_buf_simple_add_le16(msg, item->property_id);

1
components/bt/esp_ble_mesh/mesh_models/server/time_scene_server.c
View file

@ -525,6 +525,7 @@ static void send_scene_register_status(struct bt_mesh_model *model,
if ((publish == false && total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) || if ((publish == false && total_len > MIN(BLE_MESH_TX_SDU_MAX, BLE_MESH_SERVER_RSP_MAX_LEN)) ||
(publish == true && total_len > msg->size + BLE_MESH_SERVER_TRANS_MIC_SIZE)) { (publish == true && total_len > msg->size + BLE_MESH_SERVER_TRANS_MIC_SIZE)) {
/* Add this in case the message is too long */ /* Add this in case the message is too long */
BT_WARN("Too large scene register status");
break; break;
} }
net_buf_simple_add_le16(msg, scene->scene_number); net_buf_simple_add_le16(msg, scene->scene_number);