Bluetooth: Mesh: net_key_status only pull one key idx

trond-snekvik · jhedberg · commit 82083a90cc23 · 2020-04-28T21:31:18.000+03:00
Fixes bug where the config client's net_key_status handler would attempt to pull two key indexes from a message which only holds one. Fixes #24601. Signed-off-by: Trond Einar Snekvik <Trond.Einar.Snekvik@nordicsemi.no>
diff --git a/subsys/bluetooth/mesh/cfg_cli.c b/subsys/bluetooth/mesh/cfg_cli.c
@@ -152,7 +152,7 @@ static void net_key_status(struct bt_mesh_model *model,
 			   struct net_buf_simple *buf)
 {
 	struct net_key_param *param;
-	u16_t net_idx, app_idx;
+	u16_t net_idx;
 	u8_t status;
 
 	BT_DBG("net_idx 0x%04x app_idx 0x%04x src 0x%04x len %u: %s",
@@ -165,7 +165,7 @@ static void net_key_status(struct bt_mesh_model *model,
 	}
 
 	status = net_buf_simple_pull_u8(buf);
-	key_idx_unpack(buf, &net_idx, &app_idx);
+	net_idx = net_buf_simple_pull_le16(buf) & 0xfff;
 
 	param = cli->op_param;
 	if (param->net_idx != net_idx) {

Original file line number	Diff line number	Diff line change
`@@ -152,7 +152,7 @@ static void net_key_status(struct bt_mesh_model *model,`
`152`	`152`	`struct net_buf_simple *buf)`
`153`	`153`	`{`
`154`	`154`	`struct net_key_param *param;`
`155`		`- u16_t net_idx, app_idx;`
	`155`	`+ u16_t net_idx;`
`156`	`156`	`u8_t status;`
`157`	`157`
`158`	`158`	`BT_DBG("net_idx 0x%04x app_idx 0x%04x src 0x%04x len %u: %s",`
`@@ -165,7 +165,7 @@ static void net_key_status(struct bt_mesh_model *model,`
`165`	`165`	`}`
`166`	`166`
`167`	`167`	`status = net_buf_simple_pull_u8(buf);`
`168`		`- key_idx_unpack(buf, &net_idx, &app_idx);`
	`168`	`+ net_idx = net_buf_simple_pull_le16(buf) & 0xfff;`
`169`	`169`
`170`	`170`	`param = cli->op_param;`
`171`	`171`	`if (param->net_idx != net_idx) {`