Skip to content

Commit 593f952

Browse files
committed
nimble/mesh: Check buffer space before relaying proxy message
Check if there is enough space left in message buffer before appending. This prevents passing broken messages to higher layer.
1 parent ef5866c commit 593f952

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

nimble/host/mesh/src/proxy_msg.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ int bt_mesh_proxy_msg_recv(struct bt_mesh_proxy_role *role,
7373
{
7474
const uint8_t *data = buf;
7575

76+
if (net_buf_simple_tailroom(role->buf) < len - 1) {
77+
BT_WARN("Proxy role buffer overflow");
78+
return -EINVAL;
79+
}
80+
7681
switch (PDU_SAR(data)) {
7782
case SAR_COMPLETE:
7883
if (role->buf->om_len) {

0 commit comments

Comments
 (0)