[mynewt-nimble] 09/10: nimble/ll: Verify hop increment in CONNECT_IND

[an...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

andk pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git

commit 0ea070d09f96e20643ae37119addf61152bc9e6c
Author: Andrzej Kaczmarek <an...@codecoup.pl>
AuthorDate: Thu Feb 24 13:51:26 2022 +0100

    nimble/ll: Verify hop increment in CONNECT_IND
    
    We should ignore CONNECT_IND with invalid hop increment value.
    
    This fixes LL/DDI/ADV/BI-07-C.
---
 nimble/controller/src/ble_ll_conn.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c
index 0d41d10..398b4e2 100644
--- a/nimble/controller/src/ble_ll_conn.c
+++ b/nimble/controller/src/ble_ll_conn.c
@@ -3831,7 +3831,8 @@ ble_ll_conn_periph_start(uint8_t *rxbuf, uint8_t pat, struct ble_mbuf_hdr *rxhdr
         (connsm->conn_itvl < BLE_HCI_CONN_ITVL_MIN) ||
         (connsm->conn_itvl > BLE_HCI_CONN_ITVL_MAX) ||
         (connsm->tx_win_size < BLE_LL_CONN_TX_WIN_MIN) ||
-        (connsm->periph_latency > BLE_LL_CONN_PERIPH_LATENCY_MAX)) {
+        (connsm->periph_latency > BLE_LL_CONN_PERIPH_LATENCY_MAX) ||
+        (connsm->hop_inc < 5) || (connsm->hop_inc > 16)) {
         goto err_periph_start;
     }