[mynewt-nimble] branch master updated: host/l2cap: disconnect peer that sends L2CAP packets with hdr len > mtu

[ko...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

kopyscinski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git


The following commit(s) were added to refs/heads/master by this push:
     new 1969ca3  host/l2cap: disconnect peer that sends L2CAP packets with hdr len > mtu
1969ca3 is described below

commit 1969ca31127775a1895f2767d4bb3c4f53493662
Author: Krzysztof Kopyściński <kr...@codecoup.pl>
AuthorDate: Fri Nov 19 08:04:52 2021 +0100

    host/l2cap: disconnect peer that sends L2CAP packets with hdr len > mtu
    
    Rest of the checks disconnects peer if SDU size exceeds MTU, but value
    in header is OK. We should also disconnect if PDU lenght in L2CAP packet
    header exceeds it, regardles of how much data it actually contains, not
    just return error.
    
    This is affecting L2CAP/LE/CFC/BV-26-C and L2CAP/ECFC/BV-33-C
---
 nimble/host/src/ble_l2cap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nimble/host/src/ble_l2cap.c b/nimble/host/src/ble_l2cap.c
index 2bc50e0..bfbdadf 100644
--- a/nimble/host/src/ble_l2cap.c
+++ b/nimble/host/src/ble_l2cap.c
@@ -393,8 +393,11 @@ ble_l2cap_rx(struct ble_hs_conn *conn,
         }
 
         if (l2cap_hdr.len > ble_l2cap_get_mtu(chan)) {
-            /* More data then we expected on the channel */
+            /* More data than we expected on the channel.
+             * Disconnect peer with invalid behaviour
+             */
             rc = BLE_HS_EBADDATA;
+            ble_l2cap_disconnect(chan);
             goto err;
         }