(mynewt-nimble) branch master updated: nimble/host: Validate advertising instance before parsing event

[janc]

This is an automated email from the ASF dual-hosted git repository.

janc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git


The following commit(s) were added to refs/heads/master by this push:
     new f39330866 nimble/host: Validate advertising instance before parsing 
event
f39330866 is described below

commit f39330866a85fa4de49246e9d21334bc8d14f0a1
Author: Szymon Janc <szymon.j...@codecoup.pl>
AuthorDate: Mon Sep 23 15:10:28 2024 +0200

    nimble/host: Validate advertising instance before parsing event
    
    Advertising instance is used for indexing slave state array. Since
    instance is provided by host invalid handle in event means there is
    bug in controller.
---
 nimble/host/src/ble_hs_hci_evt.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nimble/host/src/ble_hs_hci_evt.c b/nimble/host/src/ble_hs_hci_evt.c
index 48012f3b4..3cb5f9858 100644
--- a/nimble/host/src/ble_hs_hci_evt.c
+++ b/nimble/host/src/ble_hs_hci_evt.c
@@ -879,6 +879,13 @@ ble_hs_hci_evt_le_adv_set_terminated(uint8_t subevent, 
const void *data,
         return BLE_HS_ECONTROLLER;
     }
 
+    /* this indicates bug in controller as host uses instances from
+     * 0-BLE_ADV_INSTANCES range only
+     */
+    if (ev->adv_handle >= BLE_ADV_INSTANCES) {
+        return BLE_HS_ECONTROLLER;
+    }
+
     if (ev->status == 0) {
         /* ignore return code as we need to terminate advertising set anyway */
         ble_gap_rx_conn_complete(&pend_conn_complete, ev->adv_handle);
@@ -900,6 +907,13 @@ ble_hs_hci_evt_le_scan_req_rcvd(uint8_t subevent, const 
void *data,
         return BLE_HS_ECONTROLLER;
     }
 
+    /* this indicates bug in controller as host uses instances from
+     * 0-BLE_ADV_INSTANCES range only
+     */
+    if (ev->adv_handle >= BLE_ADV_INSTANCES) {
+        return BLE_HS_ECONTROLLER;
+    }
+
     ble_gap_rx_scan_req_rcvd(ev);
 #endif