This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit f82365dcade45abf6d03ed41d7203d2161511ef9 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:09:33 2026 +0200 nimble/ll: Add missing length check in LE Connection Update command HCI LE Connection Update command handler did not validate parameters length before reading parameters. Reject command with invalid parameters length. Assisted-by: Claude:claude-opus-5-5 --- nimble/controller/src/ble_ll_conn_hci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nimble/controller/src/ble_ll_conn_hci.c b/nimble/controller/src/ble_ll_conn_hci.c index ed35250df..01b82ab69 100644 --- a/nimble/controller/src/ble_ll_conn_hci.c +++ b/nimble/controller/src/ble_ll_conn_hci.c @@ -1013,6 +1013,10 @@ ble_ll_conn_hci_update(const uint8_t *cmdbuf, uint8_t len) * connection update procedure. */ + if (len != sizeof(*cmd)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + /* If no connection handle exit with error */ handle = le16toh(cmd->conn_handle); connsm = ble_ll_conn_find_by_handle(handle);
