alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2025-08-15 14:36:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/fix_ble_resolve_adv_data_v5.2' into 'release/v5.2'

Browse Source 
fix(ble/bluedroid): Fixed memory out-of-bounds issue when parsing adv data (v5.2)

See merge request espressif/esp-idf!33024
This commit is contained in:
Jiang Jiang Jian
2024-08-26 10:40:48 +08:00
parent c9953e3fa0 15eb5f7f85
commit 33539d19a1
17 changed files with 151 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
components/bt/controller/esp32/bt.c
View File

@@ -92,6 +92,7 @@ do{\
#define OSI_VERSION 0x00010005
#define OSI_MAGIC_VALUE 0xFADEBEAD
#define BLE_CONTROLLER_MALLOC_CAPS (MALLOC_CAP_8BIT|MALLOC_CAP_DMA|MALLOC_CAP_INTERNAL)
/* Types definition
************************************************************************
*/
@@ -864,7 +865,21 @@ static int IRAM_ATTR cause_sw_intr_to_core_wrapper(int core_id, int intr_no)
static void *malloc_internal_wrapper(size_t size)
{
return heap_caps_malloc(size, MALLOC_CAP_8BIT|MALLOC_CAP_DMA|MALLOC_CAP_INTERNAL);
return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
}
void *malloc_ble_controller_mem(size_t size)
{
void *p = heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
if(p == NULL) {
ESP_LOGE(BTDM_LOG_TAG, "Malloc failed");
}
return p;
}
uint32_t get_ble_controller_free_heap_size(void)
{
return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
}
static int32_t IRAM_ATTR read_mac_wrapper(uint8_t mac[6])

17
components/bt/controller/esp32c3/bt.c
View File

@@ -116,6 +116,7 @@ do{\
#define BLE_PWR_HDL_INVL 0xFFFF
#define BLE_CONTROLLER_MALLOC_CAPS (MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA)
/* Types definition
************************************************************************
*/
@@ -685,13 +686,27 @@ static bool IRAM_ATTR is_in_isr_wrapper(void)
static void *malloc_internal_wrapper(size_t size)
{
void *p = heap_caps_malloc(size, MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA);
void *p = heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
if(p == NULL) {
ESP_LOGE(BT_LOG_TAG, "Malloc failed");
}
return p;
}
void *malloc_ble_controller_mem(size_t size)
{
void *p = heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
if(p == NULL) {
ESP_LOGE(BT_LOG_TAG, "Malloc failed");
}
return p;
}
uint32_t get_ble_controller_free_heap_size(void)
{
return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
}
static int IRAM_ATTR read_mac_wrapper(uint8_t mac[6])
{
int ret = esp_read_mac(mac, ESP_MAC_BT);

20
components/bt/host/bluedroid/api/esp_gap_ble_api.c
View File

@@ -485,21 +485,33 @@ esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t
return ESP_OK;
}
uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *length)
uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_len, esp_ble_adv_data_type type, uint8_t *length)
{
if (length == NULL) {
return NULL;
}
if (((type < ESP_BLE_AD_TYPE_FLAG) || (type > ESP_BLE_AD_TYPE_128SERVICE_DATA)) &&
(type != ESP_BLE_AD_MANUFACTURER_SPECIFIC_TYPE)) {
LOG_ERROR("the eir type not define, type = %x\n", type);
*length = 0;
return NULL;
}
if (adv_data == NULL) {
LOG_ERROR("Invalid p_eir data.\n");
if (adv_data == NULL || adv_data_len == 0) {
LOG_ERROR("Invalid advertising data.\n");
*length = 0;
return NULL;
}
return (BTM_CheckAdvData( adv_data, type, length));
return (BTM_CheckAdvData( adv_data, adv_data_len, type, length));
}
uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *length)
{
return esp_ble_resolve_adv_data_by_type( adv_data, ESP_BLE_ADV_DATA_LEN_MAX + ESP_BLE_SCAN_RSP_DATA_LEN_MAX, (esp_ble_adv_data_type) type, length);
}
#if (BLE_42_FEATURE_SUPPORT == TRUE)
esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_len)
{

32
components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
View File

@@ -1888,17 +1888,41 @@ esp_err_t esp_ble_gap_get_device_name(void);
*
*/
esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t * addr_type);
/**
* @brief This function is called to get ADV data for a specific type.
*
* @param[in] adv_data - pointer of ADV data which to be resolved
* @param[in] type - finding ADV data type
* @param[out] length - return the length of ADV data not including type
* @note This is the recommended function to use for resolving ADV data by type.
* It improves upon the deprecated `esp_ble_resolve_adv_data` function by
* including an additional parameter to specify the length of the ADV data,
* thereby offering better safety and reliability.
*
* @return pointer of ADV data
* @param[in] adv_data - pointer of ADV data which to be resolved
* @param[in] adv_data_len - the length of ADV data which to be resolved.
* @param[in] type - finding ADV data type
* @param[out] length - return the length of ADV data not including type
*
* @return pointer of ADV data
*
*/
uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_len, esp_ble_adv_data_type type, uint8_t *length);
/**
* @brief This function is called to get ADV data for a specific type.
*
* @note This function has been deprecated and will be removed in a future release.
* Please use `esp_ble_resolve_adv_data_by_type` instead, which provides
* better parameter validation and supports more accurate data resolution.
*
* @param[in] adv_data - pointer of ADV data which to be resolved
* @param[in] type - finding ADV data type
* @param[out] length - return the length of ADV data not including type
*
* @return pointer of ADV data
*
*/
uint8_t *esp_ble_resolve_adv_data(uint8_t *adv_data, uint8_t type, uint8_t *length);
#if (BLE_42_FEATURE_SUPPORT == TRUE)
/**
* @brief This function is called to set raw advertising data. User need to fill

18
components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
View File

@@ -2101,7 +2101,7 @@ BOOLEAN BTM_BleGetCurrentAddress(BD_ADDR addr, uint8_t *addr_type)
** Returns pointer of ADV data
**
*******************************************************************************/
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT16 adv_data_len, UINT8 type, UINT8 *p_length)
{
UINT8 *p = p_adv;
UINT8 length;
@@ -2110,7 +2110,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
STREAM_TO_UINT8(length, p);
while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
while ( length && (p - p_adv < adv_data_len)) {
STREAM_TO_UINT8(adv_type, p);
if ( adv_type == type ) {
@@ -2123,7 +2123,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
/* Break loop if advertising data is in an incorrect format,
as it may lead to memory overflow */
if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
if (p >= p_adv + adv_data_len) {
break;
}
@@ -3176,7 +3176,7 @@ UINT8 btm_ble_is_discoverable(BD_ADDR bda, UINT8 evt_type, UINT8 *p)
}
if (p_le_inq_cb->adv_len != 0) {
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache,
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len,
BTM_BLE_AD_TYPE_FLAG, &data_len)) != NULL) {
flag = * p_flag;
@@ -3392,7 +3392,7 @@ BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type
p_i->inq_count = p_inq->inq_counter; /* Mark entry for current inquiry */
if (p_le_inq_cb->adv_len != 0) {
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, BTM_BLE_AD_TYPE_FLAG, &len)) != NULL) {
if ((p_flag = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len, BTM_BLE_AD_TYPE_FLAG, &len)) != NULL) {
p_cur->flag = * p_flag;
}
}
@@ -3402,11 +3402,11 @@ BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type
* then try to convert the appearance value to a class of device value Bluedroid can use.
* Otherwise fall back to trying to infer if it is a HID device based on the service class.
*/
p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, BTM_BLE_AD_TYPE_APPEARANCE, &len);
p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len, BTM_BLE_AD_TYPE_APPEARANCE, &len);
if (p_uuid16 && len == 2) {
btm_ble_appearance_to_cod((UINT16)p_uuid16[0] | (p_uuid16[1] << 8), p_cur->dev_class);
} else {
if ((p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache,
if ((p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, p_le_inq_cb->adv_len,
BTM_BLE_AD_TYPE_16SRV_CMPL, &len)) != NULL) {
UINT8 i;
for (i = 0; i + 2 <= len; i = i + 2) {
@@ -3493,10 +3493,10 @@ void btm_send_sel_conn_callback(BD_ADDR remote_bda, UINT8 evt_type, UINT8 *p_dat
/* get the device name if exist in ADV data */
if (data_len != 0) {
p_dev_name = BTM_CheckAdvData(p_data, BTM_BLE_AD_TYPE_NAME_CMPL, &len);
p_dev_name = BTM_CheckAdvData(p_data, data_len, BTM_BLE_AD_TYPE_NAME_CMPL, &len);
if (p_dev_name == NULL) {
p_dev_name = BTM_CheckAdvData(p_data, BTM_BLE_AD_TYPE_NAME_SHORT, &len);
p_dev_name = BTM_CheckAdvData(p_data, data_len, BTM_BLE_AD_TYPE_NAME_SHORT, &len);
}
if (p_dev_name) {

2
components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h
View File

@@ -2112,7 +2112,7 @@ void BTM_BleReadControllerFeatures(tBTM_BLE_CTRL_FEATURES_CBACK *p_vsc_cback);
**
*******************************************************************************/
//extern
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length);
UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT16 adv_data_len, UINT8 type, UINT8 *p_length);
/*******************************************************************************
**