This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 301aab1a7c853fa3f61c4902709db8bcc023eab2 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:06:41 2026 +0200 nimble/ll: Add missing length check in LE Encrypt command HCI LE Encrypt command handler did not validate parameters length before reading key and plaintext. Reject command with invalid parameters length. Assisted-by: Claude:claude-opus-5-5 --- nimble/controller/src/ble_ll_hci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nimble/controller/src/ble_ll_hci.c b/nimble/controller/src/ble_ll_hci.c index 07b0aec1c..9ab1712c7 100644 --- a/nimble/controller/src/ble_ll_hci.c +++ b/nimble/controller/src/ble_ll_hci.c @@ -166,6 +166,10 @@ ble_ll_hci_le_encrypt(const uint8_t *cmdbuf, uint8_t len, uint8_t *rspbuf, struct ble_encryption_block ecb; int rc; + if (len != sizeof(*cmd)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + /* Call the link layer to encrypt the data */ swap_buf(ecb.key, cmd->key, BLE_ENC_BLOCK_SIZE); swap_buf(ecb.plain_text, cmd->data, BLE_ENC_BLOCK_SIZE);
