Bluetooth: controller: Check minimum sizes of adv PDUs
While the maximum sizes were already correctly checked by the code, the
minimum sizes of the PDUs were not. This meant that PDUs smaller than
the minimum required length (typically 6 bytes for AdvA) were
incorrectly forwarded up to the Host.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
(cherry picked from commit 3f0d7012a6f0ecfa3925baabac2006e3e6c94f71)
diff --git a/subsys/bluetooth/controller/ll_sw/nordic/lll/lll_scan.c b/subsys/bluetooth/controller/ll_sw/nordic/lll/lll_scan.c
index d53556f..cfdc7bb 100644
--- a/subsys/bluetooth/controller/ll_sw/nordic/lll/lll_scan.c
+++ b/subsys/bluetooth/controller/ll_sw/nordic/lll/lll_scan.c
@@ -1181,6 +1181,7 @@
/* Active scanner */
} else if (((pdu_adv_rx->type == PDU_ADV_TYPE_ADV_IND) ||
(pdu_adv_rx->type == PDU_ADV_TYPE_SCAN_IND)) &&
+ (pdu_adv_rx->len >= offsetof(struct pdu_adv_adv_ind, data)) &&
(pdu_adv_rx->len <= sizeof(struct pdu_adv_adv_ind)) &&
lll->type &&
#if defined(CONFIG_BT_CENTRAL)
@@ -1274,6 +1275,7 @@
else if (((((pdu_adv_rx->type == PDU_ADV_TYPE_ADV_IND) ||
(pdu_adv_rx->type == PDU_ADV_TYPE_NONCONN_IND) ||
(pdu_adv_rx->type == PDU_ADV_TYPE_SCAN_IND)) &&
+ (pdu_adv_rx->len >= offsetof(struct pdu_adv_adv_ind, data)) &&
(pdu_adv_rx->len <= sizeof(struct pdu_adv_adv_ind))) ||
((pdu_adv_rx->type == PDU_ADV_TYPE_DIRECT_IND) &&
(pdu_adv_rx->len == sizeof(struct pdu_adv_direct_ind)) &&
@@ -1287,6 +1289,7 @@
pdu_adv_rx, rl_idx)) ||
#endif /* CONFIG_BT_CTLR_ADV_EXT */
((pdu_adv_rx->type == PDU_ADV_TYPE_SCAN_RSP) &&
+ (pdu_adv_rx->len >= offsetof(struct pdu_adv_scan_rsp, data)) &&
(pdu_adv_rx->len <= sizeof(struct pdu_adv_scan_rsp)) &&
(lll->state != 0U) &&
isr_scan_rsp_adva_matches(pdu_adv_rx))) &&
@@ -1334,6 +1337,7 @@
lll_scan_adva_check(lll, pdu->tx_addr, pdu->adv_ind.addr,
rl_idx)) &&
(((pdu->type == PDU_ADV_TYPE_ADV_IND) &&
+ (pdu->len >= offsetof(struct pdu_adv_adv_ind, data)) &&
(pdu->len <= sizeof(struct pdu_adv_adv_ind))) ||
((pdu->type == PDU_ADV_TYPE_DIRECT_IND) &&
(pdu->len == sizeof(struct pdu_adv_direct_ind)) &&
