Skip to content

Cordio BLE: Fix two integer overflows (CVE-2024-48982) #386

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 21, 2024
Merged

Cordio BLE: Fix two integer overflows (CVE-2024-48982) #386

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c2414e
Cordio BLE: Fix two integer overflows
Diff-fusion Nov 18, 2024
877c70d
Cordio BLE: Fix sign in length check
Diff-fusion Nov 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2471,6 +2471,11 @@ void hciEvtProcessCmdCmpl(uint8_t *p, uint8_t len)
uint8_t cbackEvt = 0;
hciEvtCback_t cback = hciCb.evtCback;

if (len < 3)
{
return;
}

BSTREAM_TO_UINT8(numPkts, p);
BSTREAM_TO_UINT16(opcode, p);

Expand Down Expand Up @@ -2684,7 +2689,7 @@ void hciEvtProcessCmdCmpl(uint8_t *p, uint8_t len)
if (cbackEvt == HCI_UNHANDLED_CMD_CMPL_CBACK_EVT) {
const uint8_t structSize = sizeof(hciUnhandledCmdCmplEvt_t) - 1 /* removing the fake 1-byte array */;
const uint8_t remainingLen = len - 3 /* we already read opcode and numPkts */;
const uint8_t msgSize = structSize + remainingLen;
const uint16_t msgSize = structSize + remainingLen;

pMsg = WsfBufAlloc(msgSize);
if (pMsg != NULL) {
Expand Down