Skip to content

Commit

Permalink
Cordio BLE: Fix integer overflows
Browse files Browse the repository at this point in the history
  • Loading branch information
Diff-fusion committed Nov 18, 2024
1 parent cda8a9d commit 591ed09
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,10 @@ typedef struct wsfMsg_tag
/*************************************************************************************************/
void *WsfMsgDataAlloc(uint16_t len, uint8_t tailroom)
{
/* check for overflow */
if (len > UINT16_MAX - tailroom) {
return NULL;
}
return WsfMsgAlloc(len + tailroom);
}

Expand All @@ -69,6 +73,11 @@ void *WsfMsgAlloc(uint16_t len)
{
wsfMsg_t *pMsg;

/* check for overflow */
if (len > UINT16_MAX - sizeof(wsfMsg_t)) {
return NULL;
}

pMsg = WsfBufAlloc(len + sizeof(wsfMsg_t));

/* hide header */
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,12 @@ void hciTrSerialRxIncoming(uint8_t *pBuf, uint8_t len)
}

/* allocate data buffer to hold entire packet */
/* check that the length doesn't overflow */
if (hdrLen > UINT16_MAX - dataLen)
{
stateRx = HCI_RX_STATE_IDLE;
return;
}
if (pktIndRx == HCI_ACL_TYPE)
{
pPktRx = (uint8_t*)WsfMsgDataAlloc(hdrLen + dataLen, 0);
Expand Down

0 comments on commit 591ed09

Please sign in to comment.