This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 7268ae76508dea3bf5accabccde18d2519b11dd9 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:06:56 2026 +0200 nimble/ll: Add missing length check in subrate HCI commands HCI LE Set Default Subrate and LE Subrate Request command handlers did not validate parameters length before reading parameters. Reject commands with invalid parameters length. Assisted-by: Claude:claude-opus-5-5 --- nimble/controller/src/ble_ll_conn_hci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nimble/controller/src/ble_ll_conn_hci.c b/nimble/controller/src/ble_ll_conn_hci.c index 9a1de3629..68362d037 100644 --- a/nimble/controller/src/ble_ll_conn_hci.c +++ b/nimble/controller/src/ble_ll_conn_hci.c @@ -1776,6 +1776,10 @@ ble_ll_conn_hci_set_default_subrate(const uint8_t *cmdbuf, uint8_t len, uint16_t cont_num; uint16_t supervision_tmo; + if (len != sizeof(*cp)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + subrate_min = le16toh(cp->subrate_min); subrate_max = le16toh(cp->subrate_max); max_latency = le16toh(cp->max_latency); @@ -1820,6 +1824,10 @@ ble_ll_conn_hci_subrate_req(const uint8_t *cmdbuf, uint8_t len, uint16_t conn_handle; int rc; + if (len != sizeof(*cp)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + conn_handle = le16toh(cp->conn_handle); srp.subrate_min = le16toh(cp->subrate_min); srp.subrate_max = le16toh(cp->subrate_max);
