Bluetooth: controller: Check length field of adv and scan response data (abe47b70) · Commits · Wenxi XU / zephyr

subsys/bluetooth/controller/ll_sw/ll_adv.c

+8 −0

Changes for subsys/bluetooth/controller/ll_sw/ll_adv.c: 8 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -296,6 +296,10 @@ u8_t ll_adv_data_set(u8_t len, u8_t const *const data)
		struct pdu_adv *pdu;
		u8_t last;

		if (len > PDU_AC_SIZE_MAX) {
		return BT_HCI_ERR_INVALID_PARAM;
		}

		/* Dont update data if directed or extended advertising. */
		radio_adv_data = radio_adv_data_get();
		prev = (struct pdu_adv *)&radio_adv_data->data[radio_adv_data->last][0];
		@@ -352,6 +356,10 @@ u8_t ll_adv_scan_rsp_set(u8_t len, u8_t const *const data)
		struct pdu_adv *pdu;
		u8_t last;

		if (len > PDU_AC_SIZE_MAX) {
		return BT_HCI_ERR_INVALID_PARAM;
		}

		/* use the last index in double buffer, */
		radio_scan_data = radio_scan_data_get();
		if (radio_scan_data->first == radio_scan_data->last) {

+8 −0

Changes for subsys/bluetooth/controller/ll_sw/ull_adv.c: 8 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -331,6 +331,10 @@ u8_t ll_adv_data_set(u8_t len, u8_t const *const data)
		struct pdu_adv *pdu;
		u8_t idx;

		if (len > PDU_AC_SIZE_MAX) {
		return BT_HCI_ERR_INVALID_PARAM;
		}

		adv = ull_adv_set_get(handle);
		if (!adv) {
		return BT_HCI_ERR_CMD_DISALLOWED;
		@@ -382,6 +386,10 @@ u8_t ll_adv_scan_rsp_set(u8_t len, u8_t const *const data)
		struct pdu_adv *pdu;
		u8_t idx;

		if (len > PDU_AC_SIZE_MAX) {
		return BT_HCI_ERR_INVALID_PARAM;
		}

		adv = ull_adv_set_get(handle);
		if (!adv) {
		return BT_HCI_ERR_CMD_DISALLOWED;