Skip to content

Commit a9821b0

Browse files
alxelaxrlubos
authored andcommitted
[nrf fromtree] Bluetooth: Mesh: fix memory corruption if oob string i...
s 16 bytes strcpy copies string including terminating null character. strlen returns length without terminating null symbol. If oob string is 16 bytes length then strcpy will corrupt byte after auth array. Signed-off-by: Aleksandr Khromykh <[email protected]> (cherry picked from commit 7e63139)
1 parent 1637ba9 commit a9821b0

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

subsys/bluetooth/mesh/prov.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,7 @@ int bt_mesh_input_string(const char *str)
313313
return -EINVAL;
314314
}
315315

316-
strcpy((char *)bt_mesh_prov_link.auth, str);
316+
memcpy(bt_mesh_prov_link.auth, str, strlen(str));
317317

318318
bt_mesh_prov_link.role->input_complete();
319319

0 commit comments

Comments
 (0)