This fixes an array overflow that can happen if the user issues the
LE Set Periodic Advertising Data command with data length exceeding
31 bytes.
This can be noticed when running the Broadcast Source/Sink scenarios
in bluetoothctl, using emulated controllers: If the source BASE
exceeds 31 bytes, the PA reports received by the Sink looks something
like the following:
> HCI Event: LE Meta Event (0x3e) plen 39
LE Periodic Advertising Report (0x0f)
Sync handle: 1
TX power: 127 dbm (0x7f)
RSSI: not available (0x7f)
CTE Type: No Constant Tone Extension (0xff)
Data status: Incomplete, more data to come
Data length: 0x1f
25 16 51 18 e0 99 89 01 01 06 00 00 00 00 10 02
01 03 02 02 01 03 04 28 00 05 03 03 00 00 00
> HCI Event: LE Meta Event (0x3e) plen 15
LE Periodic Advertising Report (0x0f)
Sync handle: 1
TX power: 127 dbm (0x7f)
RSSI: not available (0x7f)
CTE Type: No Constant Tone Extension (0xff)
Data status: Complete
Data length: 0x07
00 00 00 00 00 00 00
The second PA report contains invalid bytes that were read outside
the PA data array.
Iulia Tanasescu (1):
btdev: Fix set PA data array overflow
emulator/btdev.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
base-commit: 41c7f3af0352d3e45f4f10b7584e955a7f5cc696
--
2.39.2
