mbox series

[BlueZ,0/1] btdev: Fix set PA data array overflow

Message ID 20240213155803.3159-1-iulia.tanasescu@nxp.com
Headers show
Series btdev: Fix set PA data array overflow | expand

Message

Iulia Tanasescu Feb. 13, 2024, 3:58 p.m. UTC 
This fixes an array overflow that can happen if the user issues the
LE Set Periodic Advertising Data command with data length exceeding
31 bytes.

This can be noticed when running the Broadcast Source/Sink scenarios
in bluetoothctl, using emulated controllers: If the source BASE
exceeds 31 bytes, the PA reports received by the Sink looks something
like the following:

> HCI Event: LE Meta Event (0x3e) plen 39
      LE Periodic Advertising Report (0x0f)
        Sync handle: 1
        TX power: 127 dbm (0x7f)
        RSSI: not available (0x7f)
        CTE Type: No Constant Tone Extension (0xff)
        Data status: Incomplete, more data to come
        Data length: 0x1f
        25 16 51 18 e0 99 89 01 01 06 00 00 00 00 10 02
        01 03 02 02 01 03 04 28 00 05 03 03 00 00 00

> HCI Event: LE Meta Event (0x3e) plen 15
      LE Periodic Advertising Report (0x0f)
        Sync handle: 1
        TX power: 127 dbm (0x7f)
        RSSI: not available (0x7f)
        CTE Type: No Constant Tone Extension (0xff)
        Data status: Complete
        Data length: 0x07
        00 00 00 00 00 00 00

The second PA report contains invalid bytes that were read outside
the PA data array.

Iulia Tanasescu (1):
  btdev: Fix set PA data array overflow

 emulator/btdev.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)


base-commit: 41c7f3af0352d3e45f4f10b7584e955a7f5cc696