From 421b9f0585c4209656c180e62b84258239094df7 Mon Sep 17 00:00:00 2001
From: andy <andy@dixon.cx>
Date: Sun, 6 Sep 2026 04:40:55 +0100
Subject: [PATCH] Fix out-of-bounds read decoding Apple iBeacon advertisements

The iBeacon branch guarded on `l >= 20` but reads p[20] (the Tx-power byte),
so a payload clamped to exactly 20 bytes read one byte past the advertising
data. Require the full 21 bytes (16 UUID + 2 major + 2 minor + 1 Tx).
---
 libble/ble_names.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libble/ble_names.c b/libble/ble_names.c
index 8344033..866015c 100644
--- a/libble/ble_names.c
+++ b/libble/ble_names.c
@@ -245,7 +245,7 @@ static void decode_apple(FuriString* out, const uint8_t* d, uint8_t len) {
         switch(type) {
         case 0x02:
             furi_string_cat_str(out, "  iBeacon");
-            if(l >= 20) {
+            if(l >= 21) { // 16 UUID + 2 major + 2 minor + 1 Tx; p[20] is the Tx byte
                 furi_string_cat_str(out, " ");
                 for(int k = 0; k < 16; k++) furi_string_cat_printf(out, "%02X", p[k]);
                 furi_string_cat_printf(