michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: Mesh: Add msg length check for Cfg and Health models

Browse source 
According to spec we should ignore messages with incorrect msg size.
This patch adds a check to every opcode handler.

Signed-off-by: Michał Narajowski <michal.narajowski@codecoup.pl>
This commit is contained in:
Michał Narajowski 2021-04-27 15:59:54 +02:00 • committed by Carles Cufí
commit ca53e86f67
6 changed files with 215 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

36
subsys/bluetooth/mesh/health_srv.c
View file

@ -279,9 +279,14 @@ static int attention_set(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
struct net_buf_simple *buf)
{
int err;
BT_DBG("");
attention_set_unrel(model, ctx, buf);
err = attention_set_unrel(model, ctx, buf);
if (err) {
return err;
}
return send_attention_status(model, ctx);
}
@ -335,25 +340,30 @@ static int health_period_set(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
struct net_buf_simple *buf)
{
int err;
BT_DBG("");
health_period_set_unrel(model, ctx, buf);
err = health_period_set_unrel(model, ctx, buf);
if (err) {
return err;
}
return send_health_period_status(model, ctx);
}
const struct bt_mesh_model_op bt_mesh_health_srv_op[] = {
{ OP_HEALTH_FAULT_GET, 2, health_fault_get },
{ OP_HEALTH_FAULT_CLEAR, 2, health_fault_clear },
{ OP_HEALTH_FAULT_CLEAR_UNREL, 2, health_fault_clear_unrel },
{ OP_HEALTH_FAULT_TEST, 3, health_fault_test },
{ OP_HEALTH_FAULT_TEST_UNREL, 3, health_fault_test_unrel },
{ OP_HEALTH_PERIOD_GET, 0, health_period_get },
{ OP_HEALTH_PERIOD_SET, 1, health_period_set },
{ OP_HEALTH_PERIOD_SET_UNREL, 1, health_period_set_unrel },
{ OP_ATTENTION_GET, 0, attention_get },
{ OP_ATTENTION_SET, 1, attention_set },
{ OP_ATTENTION_SET_UNREL, 1, attention_set_unrel },
{ OP_HEALTH_FAULT_GET, BT_MESH_LEN_EXACT(2), health_fault_get },
{ OP_HEALTH_FAULT_CLEAR, BT_MESH_LEN_EXACT(2), health_fault_clear },
{ OP_HEALTH_FAULT_CLEAR_UNREL, BT_MESH_LEN_EXACT(2), health_fault_clear_unrel },
{ OP_HEALTH_FAULT_TEST, BT_MESH_LEN_EXACT(3), health_fault_test },
{ OP_HEALTH_FAULT_TEST_UNREL, BT_MESH_LEN_EXACT(3), health_fault_test_unrel },
{ OP_HEALTH_PERIOD_GET, BT_MESH_LEN_EXACT(0), health_period_get },
{ OP_HEALTH_PERIOD_SET, BT_MESH_LEN_EXACT(1), health_period_set },
{ OP_HEALTH_PERIOD_SET_UNREL, BT_MESH_LEN_EXACT(1), health_period_set_unrel },
{ OP_ATTENTION_GET, BT_MESH_LEN_EXACT(0), attention_get },
{ OP_ATTENTION_SET, BT_MESH_LEN_EXACT(1), attention_set },
{ OP_ATTENTION_SET_UNREL, BT_MESH_LEN_EXACT(1), attention_set_unrel },
BT_MESH_MODEL_OP_END,
};