Merge branch 'bugfix/fix_bt_security' into 'master'

wmy-espressif · wmy-espressif · commit 3e0545f28b11 · 2025-10-10T09:07:49.000+08:00
fix(bt/bluedroid): Fix the boundary conditions when checking EIR data

See merge request espressif/esp-idf!42253
diff --git a/components/bt/host/bluedroid/stack/btm/btm_inq.c b/components/bt/host/bluedroid/stack/btm/btm_inq.c
@@ -2450,7 +2450,7 @@ UINT8 *BTM_CheckEirData( UINT8 *p_eir, UINT8 type, UINT8 *p_length )
 
         /* Break loop if eir data is in an incorrect format,
            as it may lead to memory overflow */
-        if ( p >= p_eir + HCI_EXT_INQ_RESPONSE_LEN ) {
+        if ( p >= p_eir + HCI_EXT_INQ_RESPONSE_LEN - 1 ) {
             break;
         }
 

Original file line number	Diff line number	Diff line change
`@@ -2450,7 +2450,7 @@ UINT8 BTM_CheckEirData( UINT8 p_eir, UINT8 type, UINT8 *p_length )`
`2450`	`2450`
`2451`	`2451`	`/* Break loop if eir data is in an incorrect format,`
`2452`	`2452`	`as it may lead to memory overflow */`
`2453`		`- if ( p >= p_eir + HCI_EXT_INQ_RESPONSE_LEN ) {`
	`2453`	`+ if ( p >= p_eir + HCI_EXT_INQ_RESPONSE_LEN - 1 ) {`
`2454`	`2454`	`break;`
`2455`	`2455`	`}`
`2456`	`2456`