@@ -111,15 +111,30 @@ static uint8_t get_data_length(uint8_t object_id)
111111static bthome_reports_t * bthome_parse_payload (uint8_t * buffer , uint8_t len )
112112{
113113 bthome_reports_t * reports = calloc (1 , sizeof (bthome_reports_t ));
114+ if (reports == NULL ) {
115+ ESP_LOGE (TAG , "calloc bthome_reports_t failed" );
116+ return NULL ;
117+ }
114118 uint16_t num_report = 0 ;
115119 int i = 0 ;
116120 while (i < len ) {
121+
122+ if (reports -> num_reports >= BTHOME_REPORTS_MAX ) {
123+ ESP_LOGE (TAG , "bthome_reports_t overflow" );
124+ bthome_free_reports (reports );
125+ return NULL ;
126+ }
127+
117128 if ((buffer [i ] >= BTHOME_BIN_SENSOR_ID_GENERIC && buffer [i ] <= BTHOME_BIN_SENSOR_ID_OPENING ) ||
118129 (buffer [i ] >= BTHOME_BIN_SENSOR_ID_BATTERY && buffer [i ] <= BTHOME_BIN_SENSOR_ID_WINDOW )) {
119130 ESP_LOGD (TAG , "bin_sensor id %d val %d\n" , buffer [i ], buffer [i + 1 ]);
120131 reports -> report [num_report ].id = buffer [i ];
121132 reports -> report [num_report ].len = 1 ;
122133 reports -> report [num_report ].data = calloc (1 , sizeof (uint8_t ) * reports -> report [num_report ].len );
134+ if (reports -> report [num_report ].data == NULL ) {
135+ bthome_free_reports (reports );
136+ return NULL ;
137+ }
123138 reports -> report [num_report ].data [0 ] = buffer [i + 1 ];
124139 reports -> num_reports = ++ num_report ;
125140 i = i + 2 ;
@@ -128,15 +143,22 @@ static bthome_reports_t *bthome_parse_payload(uint8_t *buffer, uint8_t len)
128143 reports -> report [num_report ].id = buffer [i ];
129144 reports -> report [num_report ].len = 1 ;
130145 reports -> report [num_report ].data = calloc (1 , sizeof (uint8_t ) * reports -> report [num_report ].len );
146+ if (reports -> report [num_report ].data == NULL ) {
147+ bthome_free_reports (reports );
148+ return NULL ;
149+ }
131150 reports -> report [num_report ].data [0 ] = buffer [i + 1 ];
132151 reports -> num_reports = ++ num_report ;
133152 i = i + 2 ;
134-
135153 } else if (buffer [i ] == BTHOME_EVENT_ID_DIMMER ) {
136154 ESP_LOGD (TAG , "event id %d val %d\n" , buffer [i ], buffer [i + 1 ]);
137155 reports -> report [num_report ].id = buffer [i ];
138156 reports -> report [num_report ].len = 2 ;
139157 reports -> report [num_report ].data = calloc (1 , sizeof (uint8_t ) * reports -> report [num_report ].len );
158+ if (reports -> report [num_report ].data == NULL ) {
159+ bthome_free_reports (reports );
160+ return NULL ;
161+ }
140162 reports -> report [num_report ].data [0 ] = buffer [i + 1 ];
141163 reports -> report [num_report ].data [1 ] = buffer [i + 2 ];
142164 reports -> num_reports = ++ num_report ;
@@ -146,6 +168,10 @@ static bthome_reports_t *bthome_parse_payload(uint8_t *buffer, uint8_t len)
146168 reports -> report [num_report ].id = buffer [i ];
147169 reports -> report [num_report ].len = len ;
148170 reports -> report [num_report ].data = calloc (1 , sizeof (uint8_t ) * reports -> report [num_report ].len );
171+ if (reports -> report [num_report ].data == NULL ) {
172+ bthome_free_reports (reports );
173+ return NULL ;
174+ }
149175 memcpy (reports -> report [num_report ].data , buffer + i + 2 , len );
150176 reports -> num_reports = ++ num_report ;
151177 ESP_LOGD (TAG , "sensor id %d len %d\n" , buffer [i ], len );
@@ -157,6 +183,10 @@ static bthome_reports_t *bthome_parse_payload(uint8_t *buffer, uint8_t len)
157183 reports -> report [num_report ].id = buffer [i ];
158184 reports -> report [num_report ].len = len ;
159185 reports -> report [num_report ].data = calloc (1 , sizeof (uint8_t ) * reports -> report [num_report ].len );
186+ if (reports -> report [num_report ].data == NULL ) {
187+ bthome_free_reports (reports );
188+ return NULL ;
189+ }
160190 memcpy (reports -> report [num_report ].data , buffer + i + 1 , len );
161191 ESP_LOGD (TAG , "sensor id %d len %d\n" , buffer [i ], len );
162192 reports -> num_reports = ++ num_report ;
@@ -220,13 +250,13 @@ static bthome_reports_t *bthome_parse_service_data(bthome_handle_t handle, uint8
220250 ESP_LOGD (TAG , "trigger_based_flag: %d\n" , info .bit .trigger_based_flag );
221251
222252 if (!info .bit .encryption_flag ) {
223- ESP_LOG_BUFFER_HEX ("raw payload" , data + 3 , len - 3 );
253+ ESP_LOG_BUFFER_HEX_LEVEL ("raw payload" , data + 3 , len - 3 , ESP_LOG_DEBUG );
224254 return bthome_parse_payload (data + 3 , len - 3 );
225255 } else {
226256 uint8_t payload_len = 0 ;
227257 uint8_t payload_dec [31 ];
228258 if (bthome_decrypt_payload (bthome , data , len , payload_dec , & payload_len ) == 0 ) {
229- ESP_LOG_BUFFER_HEX ("payload_dec" , payload_dec , payload_len );
259+ ESP_LOG_BUFFER_HEX_LEVEL ("payload_dec" , payload_dec , payload_len , ESP_LOG_DEBUG );
230260 return bthome_parse_payload (payload_dec , payload_len );
231261 } else {
232262 ESP_LOGE (TAG , "decrypt failed\n" );
@@ -240,7 +270,7 @@ bthome_reports_t *bthome_parse_adv_data(bthome_handle_t handle, uint8_t *adv, ui
240270{
241271 bthome_t * bthome = (bthome_t * )handle ;
242272 size_t index = 0 ;
243- // ESP_LOG_BUFFER_HEX("adv", adv, len);
273+
244274 while (index < len ) {
245275 uint8_t length = adv [index ];
246276 if (length == 0 ) {
@@ -305,6 +335,10 @@ static esp_err_t bthome_encrypt_payload(bthome_handle_t handle, const uint16_t *
305335 memcpy (nonce_p , & bthome -> counter , BTHOME_COUNTER_LEN );
306336 nonce_p += BTHOME_COUNTER_LEN ;
307337 int ret = mbedtls_ccm_encrypt_and_tag (& bthome -> aes_ctx , data_len , nonce , BTHOME_NONCE_LEN , NULL , 0 , raw_data , enc_data , tag , 4 );
338+ if (ret != 0 ) {
339+ ESP_LOGE (TAG , "mbedtls_ccm_encrypt_and_tag failed, ret %d" , ret );
340+ return ESP_FAIL ;
341+ }
308342
309343 ESP_LOGD (TAG , "raw_data:" );
310344 for (int i = 0 ; i < data_len ; i ++ ) {
@@ -427,7 +461,7 @@ esp_err_t bthome_load_params(bthome_handle_t handle)
427461 uint8_t counter [4 ];
428462 bthome -> callbacks .load (handle , BTHOME_COUNTER_KEY , counter , sizeof (counter ));
429463 memcpy (& bthome -> counter , counter , sizeof (bthome -> counter ));
430- ESP_LOGD (TAG , "load counter %d \n" , bthome -> counter );
464+ ESP_LOGD (TAG , "load counter %lu \n" , bthome -> counter );
431465 return ESP_OK ;
432466}
433467
0 commit comments