andy/flipper-bluepp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix out-of-bounds read decoding Apple iBeacon advertisements

Browse Source 
The iBeacon branch guarded on `l >= 20` but reads p[20] (the Tx-power byte),
so a payload clamped to exactly 20 bytes read one byte past the advertising
data. Require the full 21 bytes (16 UUID + 2 major + 2 minor + 1 Tx).
This commit is contained in:
andy
2026-09-06 04:40:55 +01:00
parent 73798387bb
commit 421b9f0585
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libble/ble_names.c
+1 -1
View File
@@ -245,7 +245,7 @@ static void decode_apple(FuriString* out, const uint8_t* d, uint8_t len) {
switch(type) {
case 0x02:
furi_string_cat_str(out, " iBeacon");
if(l >= 20) {
if(l >= 21) { // 16 UUID + 2 major + 2 minor + 1 Tx; p[20] is the Tx byte
furi_string_cat_str(out, " ");
for(int k = 0; k < 16; k++) furi_string_cat_printf(out, "%02X", p[k]);
furi_string_cat_printf(