+9
-1
lines changedFilter options
+9
-1
lines changed Original file line number Diff line number Diff line change
@@ -2090,15 +2090,23 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
2090
2090
2091
2091
STREAM_TO_UINT8(length, p);
2092
2092
2093
-
while ( length && (p - p_adv <= BTM_BLE_CACHE_ADV_DATA_MAX)) {
2093
+
while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
2094
2094
STREAM_TO_UINT8(adv_type, p);
2095
2095
2096
2096
if ( adv_type == type ) {
2097
2097
/* length doesn't include itself */
2098
2098
*p_length = length - 1; /* minus the length of type */
2099
2099
return p;
2100
2100
}
2101
+
2101
2102
p += length - 1; /* skip the length of data */
2103
+
2104
+
/* Break loop if advertising data is in an incorrect format,
2105
+
as it may lead to memory overflow */
2106
+
if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
2107
+
break;
2108
+
}
2109
+
2102
2110
STREAM_TO_UINT8(length, p);
2103
2111
}
2104
2112
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4