patrick/zephyr
1
0
Fork 0
Code Issues Pull requests Actions 7 Packages Projects Releases Wiki Activity

Bluetoth: controller: Fix memory corruption in RPA refresh

Browse source 
memcpy() could overwrite memory adjacent to "pdu" due to invalid
copy size.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
This commit is contained in:
Andrzej Kaczmarek 2020-12-07 12:50:20 +01:00 committed by Carles Cufí
parent 392e044548
commit f0352500b3
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
subsys/bluetooth/controller/ll_sw/ull_filter.c
View file

@ -974,7 +974,7 @@ static void rpa_adv_refresh(struct ll_adv_set *adv)
prev = lll_adv_data_peek(&adv->lll);
pdu = lll_adv_data_alloc(&adv->lll, &idx);
memcpy(pdu, prev, PDU_AC_LL_HEADER_SIZE + pdu->len);
memcpy(pdu, prev, PDU_AC_LL_HEADER_SIZE + prev->len);
ull_adv_pdu_update_addrs(adv, pdu);
lll_adv_data_enqueue(&adv->lll, idx);