pw_bluetooth_sapphire: Fix L2CAP Signaling Channel UAF Fixes a Use-After-Free (UAF) vulnerability in the BR/EDR L2CAP signaling channel. Multiple commands can be sent in a single C-frame, which are parsed and dispatched in a loop within `BrEdrSignalingChannel::DecodeRxUnit`. If a dispatched command causes a link error, the `LogicalLink` and consequently the `BrEdrSignalingChannel` are synchronously destroyed. We prevent UAF by checking if the signaling channel is still alive using a weak pointer after each command dispatch, and returning early if it was destroyed. Fixed: b/510065914 Fixed: b/535160279 Change-Id: Ib8c72dcb0acbfb6036aa6671cbb3b61a0a5e97f6 Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/482627
Pigweed is an open source collection of embedded-targeted libraries–or as we like to call them, modules. These modules are building blocks and infrastructure that enable faster and more reliable development on small-footprint MMU-less 32-bit microcontrollers like the STMicroelectronics STM32L452 or the Nordic nRF52832.
For more information please see our website: https://pigweed.dev/.