(mynewt-nimble) branch master updated: nimble/ll: Avoid dereferencing an invalid pointer

[janc]

This is an automated email from the ASF dual-hosted git repository.

janc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git


The following commit(s) were added to refs/heads/master by this push:
     new dedfaf5c9 nimble/ll: Avoid dereferencing an invalid pointer
dedfaf5c9 is described below

commit dedfaf5c9cc9c71d1b88f611548210a280745995
Author: Henrik Schnor <hsch...@mailbox.org>
AuthorDate: Fri Jun 27 15:27:10 2025 +0200

    nimble/ll: Avoid dereferencing an invalid pointer
    
    The data pointer in the mbuf of outgoing empty packets is invalid. This
    adds a check to avoid dereferencing it.
---
 nimble/controller/src/ble_ll_conn.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nimble/controller/src/ble_ll_conn.c 
b/nimble/controller/src/ble_ll_conn.c
index 52446b647..e9e5fc6f1 100644
--- a/nimble/controller/src/ble_ll_conn.c
+++ b/nimble/controller/src/ble_ll_conn.c
@@ -1341,7 +1341,8 @@ conn_tx_pdu:
         (CONN_IS_PERIPHERAL(connsm) && (md == 0) &&
          (connsm->cons_rxd_bad_crc == 0) &&
          ((connsm->last_rxd_hdr_byte & BLE_LL_DATA_HDR_MD_MASK) == 0) &&
-         !ble_ll_ctrl_is_terminate_ind(hdr_byte, m->om_data[0]))) {
+         ((connsm->flags.empty_pdu_txd) ||
+          !ble_ll_ctrl_is_terminate_ind(hdr_byte, m->om_data[0])))) {
         /* We will end the connection event */
         end_transition = BLE_PHY_TRANSITION_NONE;
         txend_func = ble_ll_conn_wait_txend;