fix(bt/bluedroid): Fix ble adv data check to avoid memory overflow

espressif · Jan 4, 2024 · c66fc14 · c66fc14
1 parent 5b5dcaa
commit c66fc14
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
@@ -2090,15 +2090,23 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
 
     STREAM_TO_UINT8(length, p);
 
-    while ( length && (p - p_adv <= BTM_BLE_CACHE_ADV_DATA_MAX)) {
+    while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
         STREAM_TO_UINT8(adv_type, p);
 
         if ( adv_type == type ) {
             /* length doesn't include itself */
             *p_length = length - 1; /* minus the length of type */
             return p;
         }
+
         p += length - 1; /* skip the length of data */
+
+        /* Break loop if advertising data is in an incorrect format,
+           as it may lead to memory overflow */
+        if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
+            break;
+        }
+
         STREAM_TO_UINT8(length, p);
     }