(mynewt-nimble) branch master updated: nimble/mesh: Add check for rx buffer in PB ADV

[janc]

This is an automated email from the ASF dual-hosted git repository.

janc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git


The following commit(s) were added to refs/heads/master by this push:
     new 4f75c0b3b nimble/mesh: Add check for rx buffer in PB ADV
4f75c0b3b is described below

commit 4f75c0b3b466186beff40e8489870c6cee076aaa
Author: Szymon Janc <szymon.j...@codecoup.pl>
AuthorDate: Mon Sep 23 14:20:15 2024 +0200

    nimble/mesh: Add check for rx buffer in PB ADV
    
    Validate if Transaction Continuation PDU can fit into buffer before
    copying data.
---
 nimble/host/mesh/src/pb_adv.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/nimble/host/mesh/src/pb_adv.c b/nimble/host/mesh/src/pb_adv.c
index 19d179c85..76b96ae36 100644
--- a/nimble/host/mesh/src/pb_adv.c
+++ b/nimble/host/mesh/src/pb_adv.c
@@ -32,6 +32,7 @@
 
 #define START_PAYLOAD_MAX 20
 #define CONT_PAYLOAD_MAX  23
+#define RX_BUFFER_MAX     65
 
 #define START_LAST_SEG(gpc) (gpc >> 2)
 #define CONT_SEG_INDEX(gpc) (gpc >> 2)
@@ -41,7 +42,8 @@
 #define LINK_ACK        0x01
 #define LINK_CLOSE      0x02
 
-#define XACT_SEG_DATA(_seg) (&link.rx.buf->om_data[20 + ((_seg - 1) * 23)])
+#define XACT_SEG_OFFSET(_seg) (20 + ((_seg - 1) * 23))
+#define XACT_SEG_DATA(_seg) (&link.rx.buf->om_data[XACT_SEG_OFFSET(_seg)])
 #define XACT_SEG_RECV(_seg) (link.rx.seg &= ~(1 << (_seg)))
 
 #define XACT_ID_MAX  0x7f
@@ -224,7 +226,7 @@ static void reset_adv_link(void)
        }
        link.tx.pending_ack = XACT_ID_NVAL;
        if (!rx_buf) {
-               rx_buf = NET_BUF_SIMPLE(65);
+               rx_buf = NET_BUF_SIMPLE(RX_BUFFER_MAX);
        }
        link.rx.buf = rx_buf;
        net_buf_simple_reset(link.rx.buf);
@@ -388,6 +390,11 @@ static void gen_prov_cont(struct prov_rx *rx, struct 
os_mbuf *buf)
                return;
        }
 
+       if (XACT_SEG_OFFSET(seg) + buf->om_len > RX_BUFFER_MAX) {
+               BT_WARN("Rx buffer overflow. Malformed generic prov frame?");
+               return;
+       }
+
        memcpy(XACT_SEG_DATA(seg), buf->om_data, buf->om_len);
        XACT_SEG_RECV(seg);
 
@@ -892,7 +899,7 @@ void pb_adv_init(void)
        k_work_init_delayable(&link.tx.retransmit, prov_retransmit);
 
     if (!rx_buf) {
-        rx_buf = NET_BUF_SIMPLE(65);
+        rx_buf = NET_BUF_SIMPLE(RX_BUFFER_MAX);
     }
     link.rx.buf = rx_buf;
     net_buf_simple_reset(link.rx.buf);