This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 4cdee9bfc067eb959cd62ca306291ff47f331d83 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:34:58 2026 +0200 nimble/ll: Add missing length check in ISO HCI commands HCI LE Setup ISO Data Path, LE Remove ISO Data Path, LE Read ISO TX Sync, LE ISO Transmit Test and LE ISO Test End command handlers did not validate parameters length before reading parameters. Reject commands with invalid parameters length. Assisted-by: Claude:claude-opus-5-5 --- nimble/controller/src/ble_ll_iso.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/nimble/controller/src/ble_ll_iso.c b/nimble/controller/src/ble_ll_iso.c index 55b4dd6d9..f8139394d 100644 --- a/nimble/controller/src/ble_ll_iso.c +++ b/nimble/controller/src/ble_ll_iso.c @@ -39,6 +39,10 @@ ble_ll_iso_setup_iso_data_path(const uint8_t *cmdbuf, uint8_t cmdlen, struct ble_ll_iso_conn *conn; uint16_t conn_handle; + if ((cmdlen < sizeof(*cmd)) || (cmdlen != sizeof(*cmd) + cmd->codec_config_len)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + conn_handle = le16toh(cmd->conn_handle); conn = ble_ll_iso_conn_find_by_handle(conn_handle); @@ -82,6 +86,10 @@ ble_ll_iso_remove_iso_data_path(const uint8_t *cmdbuf, uint8_t cmdlen, struct ble_ll_iso_conn *conn; uint16_t conn_handle; + if (cmdlen != sizeof(*cmd)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + conn_handle = le16toh(cmd->conn_handle); conn = ble_ll_iso_conn_find_by_handle(conn_handle); @@ -111,6 +119,10 @@ ble_ll_iso_read_tx_sync(const uint8_t *cmdbuf, uint8_t cmdlen, struct ble_ll_iso_conn *iso_conn; uint16_t handle; + if (cmdlen != sizeof(*cmd)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + handle = le16toh(cmd->conn_handle); iso_conn = ble_ll_iso_conn_find_by_handle(handle); if (!iso_conn) { @@ -135,6 +147,10 @@ ble_ll_iso_transmit_test(const uint8_t *cmdbuf, uint8_t cmdlen, uint8_t *rspbuf, struct ble_ll_iso_conn *conn; uint16_t handle; + if (cmdlen != sizeof(*cmd)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + handle = le16toh(cmd->conn_handle); conn = ble_ll_iso_conn_find_by_handle(handle); @@ -174,6 +190,10 @@ ble_ll_iso_end_test(const uint8_t *cmdbuf, uint8_t len, uint8_t *rspbuf, uint8_t struct ble_ll_iso_conn *iso_conn; uint16_t handle; + if (len != sizeof(*cmd)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + handle = le16toh(cmd->conn_handle); iso_conn = ble_ll_iso_conn_find_by_handle(handle); if (!iso_conn) {
