From 1530592cf060e752e3a7508cc30559712679c183 Mon Sep 17 00:00:00 2001
From: Leonard Zgrablic <32855262+lzgrablic02@users.noreply.github.com>
Date: Tue, 15 Mar 2022 16:32:52 -0400
Subject: [PATCH] BLEEndPoint ref count overflow check (#16046)

* BLEEndPoint ref count overflow check

* Assert preconditions for BLEEndPoint ref counting
---
 src/ble/BLEEndPoint.cpp | 7 +++++++
 src/ble/BLEEndPoint.h   | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/ble/BLEEndPoint.cpp b/src/ble/BLEEndPoint.cpp
index 337e72e70151f2..cfbc86d491464b 100644
--- a/src/ble/BLEEndPoint.cpp
+++ b/src/ble/BLEEndPoint.cpp
@@ -586,8 +586,15 @@ CHIP_ERROR BLEEndPoint::Init(BleLayer * bleLayer, BLE_CONNECTION_OBJECT connObj,
     return CHIP_NO_ERROR;
 }
 
+void BLEEndPoint::AddRef()
+{
+    VerifyOrDie(mRefCount < UINT32_MAX);
+    mRefCount++;
+}
+
 void BLEEndPoint::Release()
 {
+    VerifyOrDie(mRefCount > 0u);
     // Decrement the ref count.  When it reaches zero, NULL out the pointer to the chip::System::Layer
     // object. This effectively declared the object free and ready for re-allocation.
     mRefCount--;
diff --git a/src/ble/BLEEndPoint.h b/src/ble/BLEEndPoint.h
index feee860ecbd7a3..7a50256ca064a4 100644
--- a/src/ble/BLEEndPoint.h
+++ b/src/ble/BLEEndPoint.h
@@ -114,7 +114,7 @@ class DLL_EXPORT BLEEndPoint
 
     uint32_t mRefCount;
 
-    void AddRef() { mRefCount++; }
+    void AddRef();
     void Release();
 
     // Private data members: