Skip to content

Commit b973df0

Browse files
committed
nimble/transport: Skip H4 event parsing if received event is too big
If received HCI event is too big to handle just return error and stop parsing instead of overwriting data in memeory.
1 parent 0caf9ba commit b973df0

File tree

1 file changed

+3
-0
lines changed
  • nimble/transport/common/hci_h4/src

1 file changed

+3
-0
lines changed

nimble/transport/common/hci_h4/src/hci_h4.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,9 @@ hci_h4_sm_w4_header(struct hci_h4_sm *h4sm, struct hci_h4_input_buffer *ib)
168168
}
169169

170170
h4sm->exp_len = h4sm->hdr[1] + 2;
171+
if (h4sm->exp_len > MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE)) {
172+
return -1;
173+
}
171174
break;
172175
case HCI_H4_ISO:
173176
assert(h4sm->allocs && h4sm->allocs->iso);

0 commit comments

Comments
 (0)