Skip to content

Commit b973df0

Browse files
committed
nimble/transport: Skip H4 event parsing if received event is too big
If received HCI event is too big to handle just return error and stop parsing instead of overwriting data in memeory.
1 parent 0caf9ba commit b973df0

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

  • nimble/transport/common/hci_h4/src

nimble/transport/common/hci_h4/src/hci_h4.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,9 @@ hci_h4_sm_w4_header(struct hci_h4_sm *h4sm, struct hci_h4_input_buffer *ib)
168168
}
169169

170170
h4sm->exp_len = h4sm->hdr[1] + 2;
171+
if (h4sm->exp_len > MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE)) {
172+
return -1;
173+
}
171174
break;
172175
case HCI_H4_ISO:
173176
assert(h4sm->allocs && h4sm->allocs->iso);

0 commit comments

Comments
 (0)