This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 3643f30b58c868bd51e4f9177d35b05c76853dc4 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:37:08 2026 +0200 nimble/host: Add missing SDU length check in EATT ATT opcode was read from received EATT SDU without checking that the SDU is not empty. Disconnect the bearer if an empty SDU is received. Assisted-by: Claude:claude-opus-5-5 --- nimble/host/src/ble_eatt.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/nimble/host/src/ble_eatt.c b/nimble/host/src/ble_eatt.c index e99e87df8..5b3bdb354 100644 --- a/nimble/host/src/ble_eatt.c +++ b/nimble/host/src/ble_eatt.c @@ -280,6 +280,13 @@ ble_eatt_l2cap_event_fn(struct ble_l2cap_event *event, void *arg) break; case BLE_L2CAP_EVENT_COC_DATA_RECEIVED: assert(eatt->chan == event->receive.chan); + if (OS_MBUF_PKTLEN(event->receive.sdu_rx) < sizeof(opcode)) { + /* Empty SDU is not a valid ATT PDU */ + os_mbuf_free_chain(event->receive.sdu_rx); + ble_l2cap_disconnect(eatt->chan); + return BLE_HS_EREJECT; + } + opcode = event->receive.sdu_rx->om_data[0]; if (ble_eatt_supported_rsp(opcode)) { ble_npl_eventq_put(ble_hs_evq_get(), &eatt->wakeup_ev);
