Skip to content

Commit 8ef0b66

Browse files
Isl2017Isl2017
committed
Merge branch 'bugfix/ble_mesh_compile_error_o2' into 'master'
ble_mesh: Fix compile error when -O2 (performance) is chosen Closes BLEMESH-187 See merge request espressif/esp-idf!8217
2 parents 1b5c42b + fab9b94 commit 8ef0b66

File tree

17 files changed

+72
-29
lines changed

17 files changed

+72
-29
lines changed

‎components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ uint16_t *esp_ble_mesh_is_model_subscribed_to_group(esp_ble_mesh_model_t *model,
4444

4545
esp_ble_mesh_elem_t *esp_ble_mesh_find_element(uint16_t element_addr)
4646
{
47+
if (!ESP_BLE_MESH_ADDR_IS_UNICAST(element_addr)) {
48+
return NULL;
49+
}
4750
return btc_ble_mesh_elem_find(element_addr);
4851
}
4952

‎components/bt/esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,8 @@ esp_err_t esp_ble_mesh_provisioner_set_node_name(uint16_t index, const char *nam
268268

269269
arg.set_node_name.index = index;
270270
memset(arg.set_node_name.name, 0, sizeof(arg.set_node_name.name));
271-
memcpy(arg.set_node_name.name, name, strlen(name));
271+
strncpy(arg.set_node_name.name, name, ESP_BLE_MESH_NODE_NAME_MAX_LEN);
272+
272273
return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
273274
== BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
274275
}

‎components/bt/esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ esp_err_t esp_ble_mesh_node_input_string(const char *string)
118118
btc_ble_mesh_prov_args_t arg = {0};
119119
btc_msg_t msg = {0};
120120

121-
if (!string) {
121+
if (!string || strlen(string) > ESP_BLE_MESH_PROV_INPUT_OOB_MAX_LEN) {
122122
return ESP_ERR_INVALID_ARG;
123123
}
124124

@@ -128,7 +128,8 @@ esp_err_t esp_ble_mesh_node_input_string(const char *string)
128128
msg.pid = BTC_PID_PROV;
129129
msg.act = BTC_BLE_MESH_ACT_INPUT_STRING;
130130
memset(arg.input_string.string, 0, sizeof(arg.input_string.string));
131-
strncpy(arg.input_string.string, string, strlen(string));
131+
strncpy(arg.input_string.string, string,
132+
MIN(strlen(string), sizeof(arg.input_string.string)));
132133

133134
return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
134135
== BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -150,7 +151,8 @@ esp_err_t esp_ble_mesh_set_unprovisioned_device_name(const char *name)
150151
msg.act = BTC_BLE_MESH_ACT_SET_DEVICE_NAME;
151152

152153
memset(arg.set_device_name.name, 0, sizeof(arg.set_device_name.name));
153-
memcpy(arg.set_device_name.name, name, strlen(name));
154+
strncpy(arg.set_device_name.name, name, ESP_BLE_MESH_DEVICE_NAME_MAX_LEN);
155+
154156
return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
155157
== BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
156158
}
@@ -185,7 +187,8 @@ esp_err_t esp_ble_mesh_provisioner_input_string(const char *string, uint8_t link
185187
btc_ble_mesh_prov_args_t arg = {0};
186188
btc_msg_t msg = {0};
187189

188-
if (!string || link_idx >= MAX_PROV_LINK_IDX) {
190+
if (!string || strlen(string) > ESP_BLE_MESH_PROV_OUTPUT_OOB_MAX_LEN ||
191+
link_idx >= MAX_PROV_LINK_IDX) {
189192
return ESP_ERR_INVALID_ARG;
190193
}
191194

@@ -196,7 +199,8 @@ esp_err_t esp_ble_mesh_provisioner_input_string(const char *string, uint8_t link
196199
msg.act = BTC_BLE_MESH_ACT_PROVISIONER_INPUT_STR;
197200

198201
memset(arg.provisioner_input_str.string, 0, sizeof(arg.provisioner_input_str.string));
199-
strncpy(arg.provisioner_input_str.string, string, strlen(string));
202+
strncpy(arg.provisioner_input_str.string, string,
203+
MIN(strlen(string), sizeof(arg.provisioner_input_str.string)));
200204
arg.provisioner_input_str.link_idx = link_idx;
201205

202206
return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
@@ -350,6 +354,10 @@ esp_err_t esp_ble_mesh_provisioner_set_dev_uuid_match(const uint8_t *match_val,
350354
btc_ble_mesh_prov_args_t arg = {0};
351355
btc_msg_t msg = {0};
352356

357+
if (match_len + offset > ESP_BLE_MESH_OCTET16_LEN) {
358+
return ESP_ERR_INVALID_ARG;
359+
}
360+
353361
ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
354362

355363
msg.sig = BTC_SIG_API_CALL;
@@ -446,7 +454,8 @@ esp_err_t esp_ble_mesh_set_fast_prov_info(esp_ble_mesh_fast_prov_info_t *fast_pr
446454
btc_ble_mesh_prov_args_t arg = {0};
447455
btc_msg_t msg = {0};
448456

449-
if (fast_prov_info == NULL) {
457+
if (fast_prov_info == NULL || (fast_prov_info->offset +
458+
fast_prov_info->match_len > ESP_BLE_MESH_OCTET16_LEN)) {
450459
return ESP_ERR_INVALID_ARG;
451460
}
452461

‎components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,15 @@ typedef enum {
242242
ESP_BLE_MESH_PROV_OOB_ON_DEV = BIT(15),
243243
} esp_ble_mesh_prov_oob_info_t;
244244

245+
/*!< Maximum length of value used by Static OOB authentication */
246+
#define ESP_BLE_MESH_PROV_STATIC_OOB_MAX_LEN 16
247+
248+
/*!< Maximum length of string used by Output OOB authentication */
249+
#define ESP_BLE_MESH_PROV_OUTPUT_OOB_MAX_LEN 8
250+
251+
/*!< Maximum length of string used by Output OOB authentication */
252+
#define ESP_BLE_MESH_PROV_INPUT_OOB_MAX_LEN 8
253+
245254
/*!< Macros used to define message opcode */
246255
#define ESP_BLE_MESH_MODEL_OP_1(b0) (b0)
247256
#define ESP_BLE_MESH_MODEL_OP_2(b0, b1) (((b0) << 8) | (b1))
@@ -697,7 +706,7 @@ typedef struct {
697706
uint8_t dev_key[16]; /*!< Node device key */
698707

699708
/* Additional information */
700-
char name[ESP_BLE_MESH_NODE_NAME_MAX_LEN]; /*!< Node name */
709+
char name[ESP_BLE_MESH_NODE_NAME_MAX_LEN + 1]; /*!< Node name */
701710
uint16_t comp_length; /*!< Length of Composition Data */
702711
uint8_t *comp_data; /*!< Value of Composition Data */
703712
} __attribute__((packed)) esp_ble_mesh_node_t;

‎components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -560,7 +560,8 @@ static int btc_ble_mesh_output_string_cb(const char *str)
560560

561561
BT_DBG("%s", __func__);
562562

563-
strncpy(mesh_param.node_prov_output_str.string, str, strlen(str));
563+
strncpy(mesh_param.node_prov_output_str.string, str,
564+
MIN(strlen(str), sizeof(mesh_param.node_prov_output_str.string)));
564565

565566
ret = btc_ble_mesh_prov_callback(&mesh_param, ESP_BLE_MESH_NODE_PROV_OUTPUT_STRING_EVT);
566567
return (ret == BT_STATUS_SUCCESS) ? 0 : -1;

‎components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ typedef union {
103103
char string[8];
104104
} input_string;
105105
struct ble_mesh_set_device_name_args {
106-
char name[ESP_BLE_MESH_DEVICE_NAME_MAX_LEN];
106+
char name[ESP_BLE_MESH_DEVICE_NAME_MAX_LEN + 1];
107107
} set_device_name;
108108
struct ble_mesh_provisioner_read_oob_pub_key_args {
109109
uint8_t link_idx;
@@ -157,7 +157,7 @@ typedef union {
157157
} set_primary_elem_addr;
158158
struct ble_mesh_provisioner_set_node_name_args {
159159
uint16_t index;
160-
char name[ESP_BLE_MESH_NODE_NAME_MAX_LEN];
160+
char name[ESP_BLE_MESH_NODE_NAME_MAX_LEN + 1];
161161
} set_node_name;
162162
struct ble_mesh_provisioner_add_local_app_key_args {
163163
uint8_t app_key[16];

‎components/bt/esp_ble_mesh/mesh_core/include/mesh_main.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@ typedef enum {
6262
BLE_MESH_PROV_OOB_ON_DEV = BIT(15),
6363
} bt_mesh_prov_oob_info_t;
6464

65+
#define BLE_MESH_PROV_STATIC_OOB_MAX_LEN 16
66+
#define BLE_MESH_PROV_OUTPUT_OOB_MAX_LEN 8
67+
#define BLE_MESH_PROV_INPUT_OOB_MAX_LEN 8
68+
6569
/** Provisioning properties & capabilities. */
6670
struct bt_mesh_prov {
6771
#if CONFIG_BLE_MESH_NODE

‎components/bt/esp_ble_mesh/mesh_core/prov.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1743,6 +1743,13 @@ int bt_mesh_prov_init(const struct bt_mesh_prov *prov_info)
17431743
return -EINVAL;
17441744
}
17451745

1746+
if (prov_info->static_val_len > BLE_MESH_PROV_STATIC_OOB_MAX_LEN ||
1747+
prov_info->output_size > BLE_MESH_PROV_OUTPUT_OOB_MAX_LEN ||
1748+
prov_info->input_size > BLE_MESH_PROV_INPUT_OOB_MAX_LEN) {
1749+
BT_ERR("%s, Invalid auth oob length", __func__);
1750+
return -EINVAL;
1751+
}
1752+
17461753
/* Changed by Espressif. Use micro-ecc to generate public key now. */
17471754
key = bt_mesh_pub_key_get();
17481755
if (!key) {

‎components/bt/esp_ble_mesh/mesh_core/provisioner_main.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -490,6 +490,8 @@ int bt_mesh_provisioner_restore_node_name(u16_t addr, const char *name)
490490
}
491491

492492
strncpy(node->name, name, BLE_MESH_NODE_NAME_SIZE);
493+
node->name[BLE_MESH_NODE_NAME_SIZE] = 0;
494+
493495
return 0;
494496
}
495497

@@ -625,7 +627,7 @@ int bt_mesh_provisioner_set_node_name(u16_t index, const char *name)
625627
}
626628
}
627629

628-
memset(mesh_nodes[index]->name, 0, BLE_MESH_NODE_NAME_SIZE);
630+
memset(mesh_nodes[index]->name, 0, sizeof(mesh_nodes[index]->name));
629631
strncpy(mesh_nodes[index]->name, name, length);
630632

631633
if (IS_ENABLED(CONFIG_BLE_MESH_SETTINGS)) {

‎components/bt/esp_ble_mesh/mesh_core/provisioner_main.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ struct bt_mesh_node {
4242
u8_t dev_key[16]; /* Node device key */
4343

4444
/* Additional information */
45-
char name[BLE_MESH_NODE_NAME_SIZE]; /* Node name */
45+
char name[BLE_MESH_NODE_NAME_SIZE + 1]; /* Node name */
4646
u16_t comp_length; /* Length of Composition Data */
4747
u8_t *comp_data; /* Value of Composition Data */
4848
} __packed;

‎components/bt/esp_ble_mesh/mesh_core/provisioner_prov.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2178,6 +2178,11 @@ int bt_mesh_provisioner_set_oob_output_data(const u8_t idx, const u8_t *num, u8_
21782178
* Parameter num_flag is used to indicate whether the value
21792179
* output by provisioner is number or string.
21802180
*/
2181+
if (num == NULL || size > BLE_MESH_PROV_INPUT_OOB_MAX_LEN) {
2182+
BT_ERR("%s, Invalid parameter", __func__);
2183+
return -EINVAL;
2184+
}
2185+
21812186
if (!link[idx].auth) {
21822187
BT_ERR("%s, link auth is NULL", __func__);
21832188
return -EINVAL;

‎components/bt/esp_ble_mesh/mesh_core/proxy_client.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -660,6 +660,11 @@ void bt_mesh_proxy_client_adv_ind_recv(struct net_buf_simple *buf, const bt_mesh
660660

661661
switch (type) {
662662
case BLE_MESH_PROXY_ADV_NET_ID: {
663+
if (buf->len != sizeof(ctx.net_id.net_id)) {
664+
BT_WARN("Malformed Network ID");
665+
return;
666+
}
667+
663668
struct bt_mesh_subnet *sub = NULL;
664669
sub = bt_mesh_is_net_id_exist(buf->data);
665670
if (!sub) {

‎components/bt/esp_ble_mesh/mesh_core/proxy_server.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ static enum {
109109
MESH_GATT_PROXY,
110110
} gatt_svc = MESH_GATT_NONE;
111111

112-
static char device_name[DEVICE_NAME_SIZE] = "ESP-BLE-MESH";
112+
static char device_name[DEVICE_NAME_SIZE + 1] = "ESP-BLE-MESH";
113113

114114
int bt_mesh_set_device_name(const char *name)
115115
{
@@ -124,7 +124,7 @@ int bt_mesh_set_device_name(const char *name)
124124
}
125125

126126
memset(device_name, 0x0, sizeof(device_name));
127-
memcpy(device_name, name, strlen(name));
127+
strncpy(device_name, name, DEVICE_NAME_SIZE);
128128

129129
return bt_mesh_gatts_set_local_device_name(device_name);
130130
}

‎components/bt/esp_ble_mesh/mesh_core/settings.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1081,7 +1081,7 @@ static int node_info_set(u16_t addr, bool *exist)
10811081

10821082
static int node_name_set(u16_t addr)
10831083
{
1084-
char name[BLE_MESH_NODE_NAME_SIZE] = {0};
1084+
char name[BLE_MESH_NODE_NAME_SIZE + 1] = {0};
10851085
char get[16] = {'\0'};
10861086
bool exist = false;
10871087
int err = 0;
@@ -2513,7 +2513,7 @@ void bt_mesh_clear_node_info(u16_t unicast_addr)
25132513

25142514
void bt_mesh_store_node_name(struct bt_mesh_node *node)
25152515
{
2516-
char node_name[BLE_MESH_NODE_NAME_SIZE] = {0};
2516+
char node_name[BLE_MESH_NODE_NAME_SIZE + 1] = {0};
25172517
char name[16] = {'\0'};
25182518
int err = 0;
25192519

@@ -2522,7 +2522,7 @@ void bt_mesh_store_node_name(struct bt_mesh_node *node)
25222522
return;
25232523
}
25242524

2525-
strncpy(node_name, node->name, BLE_MESH_NODE_NAME_SIZE);
2525+
strncpy(node_name, node->name, BLE_MESH_NODE_NAME_SIZE + 1);
25262526

25272527
sprintf(name, "mesh/pn/%04x/n", node->unicast_addr);
25282528
err = bt_mesh_save_core_settings(name, (const u8_t *)node_name, BLE_MESH_NODE_NAME_SIZE);

‎examples/bluetooth/esp_ble_mesh/ble_mesh_fast_provision/ble_mesh_fast_prov_client/main/ble_mesh_demo_main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ static void provisioner_prov_complete(int node_index, const uint8_t uuid[16], ui
138138
uint8_t elem_num, uint16_t net_idx)
139139
{
140140
example_node_info_t *node = NULL;
141-
char name[10];
141+
char name[11] = {0};
142142
esp_err_t err;
143143

144144
ESP_LOGI(TAG, "Node index: 0x%x, unicast address: 0x%02x, element num: %d, netkey index: 0x%02x",

‎examples/bluetooth/esp_ble_mesh/ble_mesh_provisioner/main/ble_mesh_demo_main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ static esp_err_t prov_complete(int node_idx, const esp_ble_mesh_octet16_t uuid,
191191
esp_ble_mesh_client_common_param_t common = {0};
192192
esp_ble_mesh_cfg_client_get_state_t get_state = {0};
193193
esp_ble_mesh_node_info_t *node = NULL;
194-
char name[10];
194+
char name[11] = {0};
195195
int err;
196196

197197
ESP_LOGI(TAG, "node index: 0x%x, unicast address: 0x%02x, element num: %d, netkey index: 0x%02x",

‎examples/bluetooth/esp_ble_mesh/common_vendor_models/fast_prov_vendor_model/components/esp_fast_prov_server_model.c

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ esp_err_t example_fast_prov_server_recv_msg(esp_ble_mesh_model_t *model,
139139
* status_bit_mask (2) + status_ctx_flag (1) + status_unicast (1) + status_net_idx (1) +
140140
* status_group (1) + status_pri_prov (1) + status_match (1) + status_action (1).
141141
*/
142-
uint8_t match_len = 0, match_val[16];
142+
uint8_t match_len = 0, match_val[16] = {0};
143143
uint8_t status_unicast = 0;
144144
uint8_t flags = 0;
145145

@@ -186,6 +186,11 @@ esp_err_t example_fast_prov_server_recv_msg(esp_ble_mesh_model_t *model,
186186
uint16_t pri_prov_addr = (ctx_flags & BIT(7)) ? net_buf_simple_pull_le16(buf) : ESP_BLE_MESH_ADDR_UNASSIGNED;
187187
if (ctx_flags & BIT(8)) {
188188
match_len = buf->len - ((ctx_flags & BIT(9)) ? 1 : 0);
189+
if (match_len > ESP_BLE_MESH_OCTET16_LEN) {
190+
net_buf_simple_add_le16(msg, BIT(5));
191+
net_buf_simple_add_u8(msg, 0x01); /* too large match value length */
192+
break;
193+
}
189194
memcpy(match_val, buf->data, match_len);
190195
net_buf_simple_pull(buf, match_len);
191196
}
@@ -249,14 +254,6 @@ esp_err_t example_fast_prov_server_recv_msg(esp_ble_mesh_model_t *model,
249254
}
250255
}
251256

252-
if (ctx_flags & BIT(8)) {
253-
if (match_len > 16) {
254-
net_buf_simple_add_le16(msg, BIT(5));
255-
net_buf_simple_add_u8(msg, 0x01); /* too large match value length */
256-
break;
257-
}
258-
}
259-
260257
if (ctx_flags & BIT(9)) {
261258
if ((action & BIT_MASK(2)) != FAST_PROV_ACT_ENTER) {
262259
net_buf_simple_add_le16(msg, BIT(6));

0 commit comments

Comments
 (0)