bluetil: Ensure advertisement length does not exceed pkt len

RIOT-OS · Oct 1, 2024 · 4dcb162 · 4dcb162
1 parent 61df141
commit 4dcb162
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/sys/net/ble/bluetil/bluetil_ad/bluetil_ad.c b/sys/net/ble/bluetil/bluetil_ad/bluetil_ad.c
@@ -44,9 +44,12 @@ int bluetil_ad_find(const bluetil_ad_t *ad, uint8_t type,
 
     unsigned pos = 0;
 
-    while ((pos + POS_TYPE) < ad->pos) {
+    while ((pos + POS_DATA) < ad->pos) {
         uint8_t len = ad->buf[pos];
 
+        if (pos + len >= ad->pos)
+            return BLUETIL_AD_NOMEM;
+
         if (ad->buf[pos + POS_TYPE] == type) {
             data->data = ad->buf + pos + POS_DATA;
             data->len = len - 1;           /* take away the type field */