Commit 79d575bf authored by Joakim Andersson's avatar Joakim Andersson Committed by Carles Cufi
Browse files

Bluetooth: controller: Check length field of scan response data 



Check the length field of the scan response data.

Signed-off-by: default avatarJoakim Andersson <joakim.andersson@nordicsemi.no>
parent dabf2375

subsys/bluetooth/controller/ll_sw/ull_adv.c

+4 −0
Original line number Diff line number Diff line
@@ -1539,6 +1539,10 @@ uint8_t ull_scan_rsp_set(struct ll_adv_set *adv, uint8_t len, 
	struct pdu_adv *pdu;

	uint8_t idx;



	if (len > PDU_AC_DATA_SIZE_MAX) {

		return BT_HCI_ERR_INVALID_PARAM;

	}



	/* update scan pdu fields. */

	prev = lll_adv_scan_rsp_peek(&adv->lll);

	pdu = lll_adv_scan_rsp_alloc(&adv->lll, &idx);

CRA Git | Maintained and supported by SUSTech CRA and CCSE