michaelh/zephyr
1
0
Fork 0
Code Releases Activity

bluetooth: shell: pairing_accept callback access NULL pointer

Browse source 
pairing_accept callback is called with feat as NULL in
the bt_hci_io_capa_req.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
This commit is contained in:
Mark Wang 2025-05-19 18:43:34 +08:00 • committed by Benjamin Cabé
commit 18c18c6905
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
subsys/bluetooth/host/shell/bt.c
View file

@ -4217,12 +4217,16 @@ static void auth_pincode_entry(struct bt_conn *conn, bool highsec)
enum bt_security_err pairing_accept(struct bt_conn *conn, enum bt_security_err pairing_accept(struct bt_conn *conn,
const struct bt_conn_pairing_feat *const feat) const struct bt_conn_pairing_feat *const feat)
{ {
if (feat != NULL) {
bt_shell_print("Remote pairing features: " bt_shell_print("Remote pairing features: "
"IO: 0x%02x, OOB: %d, AUTH: 0x%02x, Key: %d, " "IO: 0x%02x, OOB: %d, AUTH: 0x%02x, Key: %d, "
"Init Kdist: 0x%02x, Resp Kdist: 0x%02x", "Init Kdist: 0x%02x, Resp Kdist: 0x%02x",
feat->io_capability, feat->oob_data_flag, feat->io_capability, feat->oob_data_flag,
feat->auth_req, feat->max_enc_key_size, feat->auth_req, feat->max_enc_key_size,
feat->init_key_dist, feat->resp_key_dist); feat->init_key_dist, feat->resp_key_dist);
} else {
bt_shell_print("Remote pairing");
}
return BT_SECURITY_ERR_SUCCESS; return BT_SECURITY_ERR_SUCCESS;
} }