michaelh/zephyr
1
0
Fork 0
Code Releases Activity

drivers/nble: Add proper boundary checks for function tables

Browse source 
We should just discard the data if the received table index goes
beyond the actual table size.

Change-Id: I267621f098e349abab5a1f37f485a28448a9396b
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
This commit is contained in:
Johan Hedberg 2016-02-12 14:30:47 +02:00
commit c3ba08c552
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/nble/rpc_deserialize.c
View file

@ -478,49 +478,49 @@ void rpc_deserialize(struct net_buf *buf)
switch (sig_type) {
case SIG_TYPE_NONE:
if (sizeof(m_fct_none)) {
if (fn_index < ARRAY_SIZE(m_fct_none)) {
BT_DBG("%s", debug_func_none[fn_index]);
deserialize_none(fn_index, buf);
}
break;
case SIG_TYPE_S:
if (sizeof(m_fct_s)) {
if (fn_index < ARRAY_SIZE(m_fct_s)) {
BT_DBG("%s", debug_func_s[fn_index]);
deserialize_s(fn_index, buf);
}
break;
case SIG_TYPE_P:
if (sizeof(m_fct_p)) {
if (fn_index < ARRAY_SIZE(m_fct_p)) {
BT_DBG("%s", debug_func_p[fn_index]);
deserialize_p(fn_index, buf);
}
break;
case SIG_TYPE_S_B:
if (sizeof(m_fct_s_b)) {
if (fn_index < ARRAY_SIZE(m_fct_s_b)) {
BT_DBG("%s", debug_func_s_b[fn_index]);
deserialize_s_b(fn_index, buf);
}
break;
case SIG_TYPE_B_B_P:
if (sizeof(m_fct_b_b_p)) {
if (fn_index < ARRAY_SIZE(m_fct_b_b_p)) {
BT_DBG("%s", debug_func_b_b_p[fn_index]);
deserialize_b_b_p(fn_index, buf);
}
break;
case SIG_TYPE_S_P:
if (sizeof(m_fct_s_p)) {
if (fn_index < ARRAY_SIZE(m_fct_s_p)) {
BT_DBG("%s", debug_func_s_p[fn_index]);
deserialize_s_p(fn_index, buf);
}
break;
case SIG_TYPE_S_B_P:
if (sizeof(m_fct_s_b_p)) {
if (fn_index < ARRAY_SIZE(m_fct_s_b_p)) {
BT_DBG("%s", debug_func_s_b_p[fn_index]);
deserialize_s_b_p(fn_index, buf);
}
break;
case SIG_TYPE_S_B_B_P:
if (sizeof(m_fct_s_b_b_p)) {
if (fn_index < ARRAY_SIZE(m_fct_s_b_b_p)) {
BT_DBG("%s", debug_func_s_b_b_p[fn_index]);
deserialize_s_b_b_p(fn_index, buf);
}