Skip to content

Commit b5fc368

Browse files
bigbearishappyfacchinm
authored andcommitted
fix the potential overflow problem of leAdvertisingReport->eirData
1 parent 2a1cf72 commit b5fc368

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

src/utility/HCI.cpp

+4
Original file line numberDiff line numberDiff line change
@@ -1116,6 +1116,10 @@ void HCIClass::handleEventPkt(uint8_t /*plen*/, uint8_t pdata[])
11161116
uint8_t eirData[31];
11171117
} *leAdvertisingReport = (EvtLeAdvertisingReport*)&pdata[sizeof(HCIEventHdr) + sizeof(LeMetaEventHeader)];
11181118

1119+
if(leAdvertisingReport->eirLength > sizeof(leAdvertisingReport->eirData)){
1120+
return ;
1121+
}
1122+
11191123
if (leAdvertisingReport->status == 0x01) {
11201124
// last byte is RSSI
11211125
int8_t rssi = leAdvertisingReport->eirData[leAdvertisingReport->eirLength];

0 commit comments

Comments
 (0)