Merge pull request #20881 from Teufelchen1/fix/rpble

bluetil: Ensure advertisement length does not exceed pkt len
RIOT-OS · Oct 3, 2024 · 248371e · 248371e
2 parents 8a933a5 + 84f1ae3
commit 248371e
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/sys/net/ble/bluetil/bluetil_ad/bluetil_ad.c b/sys/net/ble/bluetil/bluetil_ad/bluetil_ad.c
@@ -44,9 +44,13 @@ int bluetil_ad_find(const bluetil_ad_t *ad, uint8_t type,
 
     unsigned pos = 0;
 
-    while ((pos + POS_TYPE) < ad->pos) {
+    while ((pos + POS_DATA) < ad->pos) {
         uint8_t len = ad->buf[pos];
 
+        if (pos + len >= ad->pos) {
+            return BLUETIL_AD_NOMEM;
+        }
+
         if (ad->buf[pos + POS_TYPE] == type) {
             data->data = ad->buf + pos + POS_DATA;
             data->len = len - 1;           /* take away the type field */