Merge pull request #2254 from nvt/check-ble-sdu-length

Check available packetbuf space before writing to it in ble-l2cap
contiki-ng · Nov 4, 2022 · 506f9de · 506f9de
2 parents c233437 + 20ae1a0
commit 506f9de
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/os/net/mac/ble/ble-l2cap.c b/os/net/mac/ble/ble-l2cap.c
@@ -452,6 +452,12 @@ input_l2cap_frame_flow_channel(l2cap_channel_t *channel, uint8_t *data, uint16_t
 
   if((channel->rx_buffer.sdu_length > 0) &&
      (channel->rx_buffer.sdu_length == channel->rx_buffer.current_index)) {
+    if(channel->rx_buffer.sdu_length > packetbuf_remaininglen()) {
+      LOG_WARN("l2cap_frame: illegal L2CAP frame sdu_length: %"PRIu16"\n",
+               channel->rx_buffer.sdu_length);
+      return;
+    }
+
     /* do not use packetbuf_copyfrom here because the packetbuf_attr
      * must not be cleared */
     memcpy(packetbuf_dataptr(), channel->rx_buffer.sdu, channel->rx_buffer.sdu_length);