From: Marcel Holtmann Date: Thu, 19 Nov 2015 15:16:41 +0000 (+0100) Subject: Bluetooth: Add instance range check for Add Advertising command X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=ceff86af56e09469d21732c16fd27a7337983c48;p=openwrt%2Fstaging%2Fblogic.git Bluetooth: Add instance range check for Add Advertising command The instance range check for Add Advertising command is missing. If the provided instance is out of range an Invalid Parameters error should be returned. At the moment, the generic Failed error is returned. This extra check ensures that clear error messages are returned. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg --- diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index eca203e891d2..2c6533a3f937 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -6839,6 +6839,10 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev, return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, status); + if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES) + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, + MGMT_STATUS_INVALID_PARAMS); + flags = __le32_to_cpu(cp->flags); timeout = __le16_to_cpu(cp->timeout); duration = __le16_to_cpu(cp->duration);