This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 1d702737fd9c4d983c6bfae2816222c1241673c6 Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 18:10:00 2026 +0200 nimble/ll: Add missing length check in LE Request Peer SCA command HCI LE Request Peer SCA command handler did not validate parameters length before reading connection handle. Reject command with invalid parameters length. Assisted-by: Claude:claude-opus-5-5 --- nimble/controller/src/ble_ll_conn_hci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nimble/controller/src/ble_ll_conn_hci.c b/nimble/controller/src/ble_ll_conn_hci.c index 01b82ab69..4407610c2 100644 --- a/nimble/controller/src/ble_ll_conn_hci.c +++ b/nimble/controller/src/ble_ll_conn_hci.c @@ -1747,6 +1747,10 @@ ble_ll_conn_req_peer_sca(const uint8_t *cmdbuf, uint8_t len, const struct ble_hci_le_request_peer_sca_cp *params = (const void *)cmdbuf; struct ble_ll_conn_sm *connsm; + if (len != sizeof(*params)) { + return BLE_ERR_INV_HCI_CMD_PARMS; + } + connsm = ble_ll_conn_find_by_handle(le16toh(params->conn_handle)); if (!connsm) { return BLE_ERR_UNK_CONN_ID;
