(mynewt-nimble) branch master updated: nimble/transport: Skip H4 event parsing if received event is too big

[janc]

This is an automated email from the ASF dual-hosted git repository.

janc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git


The following commit(s) were added to refs/heads/master by this push:
     new b973df0c6 nimble/transport: Skip H4 event parsing if received event is 
too big
b973df0c6 is described below

commit b973df0c6cf7b30efbf8eb2cafdc1ee843464b76
Author: Szymon Janc <szymon.j...@codecoup.pl>
AuthorDate: Mon Jun 30 15:31:04 2025 +0200

    nimble/transport: Skip H4 event parsing if received event is too big
    
    If received HCI event is too big to handle just return error and
    stop parsing instead of overwriting data in memeory.
---
 nimble/transport/common/hci_h4/src/hci_h4.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nimble/transport/common/hci_h4/src/hci_h4.c 
b/nimble/transport/common/hci_h4/src/hci_h4.c
index 9af046ab6..fd89154a3 100644
--- a/nimble/transport/common/hci_h4/src/hci_h4.c
+++ b/nimble/transport/common/hci_h4/src/hci_h4.c
@@ -168,6 +168,9 @@ hci_h4_sm_w4_header(struct hci_h4_sm *h4sm, struct 
hci_h4_input_buffer *ib)
         }
 
         h4sm->exp_len = h4sm->hdr[1] + 2;
+        if (h4sm->exp_len > MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE)) {
+            return -1;
+        }
         break;
     case HCI_H4_ISO:
         assert(h4sm->allocs && h4sm->allocs->iso);