[nrf fromtree] Bluetooth: Host: Validate periodic advertising report length - #4496
Merged
rlubos merged 3 commits intoSep 24, 2026
Merged
Conversation
hermabe
approved these changes
Sep 21, 2026
fredaas
approved these changes
Sep 21, 2026
knutel-nordic
force-pushed
the
validate-periodic-adv-report-length
branch
from
September 22, 2026 11:00
856ca21 to
f297b41
Compare
NordicBuilder
added a commit
to NordicBuilder/sdk-nrf
that referenced
this pull request
Sep 22, 2026
Automatically created by action-manifest-pr GH action from PR: nrfconnect/sdk-zephyr#4496 Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
…bricated responses The fake controller responds to LE Set Extended Scan Parameters, LE Set Extended Scan Enable and Reset with Command Complete events that carry no return parameters, although these commands return a status. The host has been reading the status from beyond the fabricated event parameters, which happened to yield success. Add the status return parameter, like the other status-only commands in the table already have, in preparation for the host validating command responses against the event length. Assisted-by: Claude:claude-fable-5 Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com> (cherry picked from commit 8f2fea1)
…length The periodic advertising report handler checks that the event header is present and that the data fits in the reassembly buffer, but not that the event actually carries as many data bytes as its length field claims. With CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0, a report with a length field larger than the remaining event payload makes net_buf_simple_add_mem() copy up to 255 bytes from beyond the end of the HCI event buffer into the reassembly buffer, and the result is passed on to the application. Drop such reports the same way as reports that do not fit in the reassembly buffer. Fixes #117587 Assisted-by: Claude:claude-fable-5 Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com> (cherry picked from commit e9c3252)
knutel-nordic
force-pushed
the
validate-periodic-adv-report-length
branch
from
September 22, 2026 11:40
f297b41 to
6a2266f
Compare
NordicBuilder
added a commit
to NordicBuilder/sdk-nrf
that referenced
this pull request
Sep 22, 2026
Automatically created by action-manifest-pr GH action from PR: nrfconnect/sdk-zephyr#4496 Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
…riodic report test Enable periodic advertising sync in the test configuration and add a test which establishes a sync with the fake controller and sends periodic advertising reports whose length field claims more data than the event carries. The reports must be dropped without invoking the receive callback, and the sync must remain usable afterwards. Assisted-by: Claude:claude-fable-5 Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com> (cherry picked from commit 3da48bd)
knutel-nordic
force-pushed
the
validate-periodic-adv-report-length
branch
from
September 24, 2026 05:24
6a2266f to
0a71742
Compare
NordicBuilder
added a commit
to NordicBuilder/sdk-nrf
that referenced
this pull request
Sep 24, 2026
Automatically created by action-manifest-pr GH action from PR: nrfconnect/sdk-zephyr#4496 Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
NordicBuilder
added a commit
to NordicBuilder/sdk-nrf
that referenced
this pull request
Sep 24, 2026
Automatically created by action-manifest-pr GH action from PR: nrfconnect/sdk-zephyr#4496 Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
rlubos
pushed a commit
to nrfconnect/sdk-nrf
that referenced
this pull request
Sep 24, 2026
Automatically created by action-manifest-pr GH action from PR: nrfconnect/sdk-zephyr#4496 Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fromtree Bluetooth: Host: Validate periodic advertising report length