Mirrors_Framework/esphome
1
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2026-08-17 10:52:56 +08:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

[bluetooth_proxy] Bound GATT characteristic/descriptor enumeration to allocated size (#17625)

Browse Source
This commit is contained in:
Jonathan Swoboda
2026-07-16 15:32:09 -04:00
committed by GitHub
parent 72bd45538e
commit 09da2766ed
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esphome/components/bluetooth_proxy/bluetooth_connection.cpp
+4 -2
View File
@@ -245,7 +245,9 @@ void BluetoothConnection::send_service_for_discovery_() {
service_resp.characteristics.init(total_char_count);
uint16_t char_offset = 0;
esp_gattc_char_elem_t char_result;
while (true) { // characteristics
// Bound by total_char_count: the vector is sized for it, and a malicious peripheral
// can make enumeration return more entries than the count query reported
while (char_offset < total_char_count) { // characteristics
uint16_t char_count = 1;
esp_gatt_status_t char_status =
esp_ble_gattc_get_all_char(this->gattc_if_, this->conn_id_, service_result.start_handle,
@@ -287,7 +289,7 @@ void BluetoothConnection::send_service_for_discovery_() {
characteristic_resp.descriptors.init(total_desc_count);
uint16_t desc_offset = 0;
esp_gattc_descr_elem_t desc_result;
while (true) { // descriptors
while (desc_offset < total_desc_count) { // descriptors
uint16_t desc_count = 1;
esp_gatt_status_t desc_status = esp_ble_gattc_get_all_descr(
this->gattc_if_, this->conn_id_, char_result.char_handle, &desc_result, &desc_count, desc_offset);