Merge pull request #301 from seuros/fix-bluetooth-buffer-overflow

nightlyupdates · web-flow · commit d3096344a813 · 2025-10-05T16:57:34.000+05:30
Fix critical buffer overflow vulnerability in Bluetooth REPL
diff --git a/source/application/luaport.c b/source/application/luaport.c
@@ -39,6 +39,13 @@ static volatile char repl_buffer[BLE_PREFERRED_MAX_MTU];
 
 void lua_write_to_repl(uint8_t *buffer, uint8_t length)
 {
+    // Bounds check to prevent buffer overflow (CVE-PENDING)
+    // Buffer size is BLE_PREFERRED_MAX_MTU (247), length can be 0-255
+    if (length >= BLE_PREFERRED_MAX_MTU)
+    {
+        length = BLE_PREFERRED_MAX_MTU - 1; // Reserve space for null terminator
+    }
+
     // Loop copy because memcpy isn't compatible with volatile
     for (size_t buffer_index = 0; buffer_index < length; buffer_index++)
     {

Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,13 @@ static volatile char repl_buffer[BLE_PREFERRED_MAX_MTU];`
`39`	`39`
`40`	`40`	`void lua_write_to_repl(uint8_t *buffer, uint8_t length)`
`41`	`41`	`{`
	`42`	`+ // Bounds check to prevent buffer overflow (CVE-PENDING)`
	`43`	`+ // Buffer size is BLE_PREFERRED_MAX_MTU (247), length can be 0-255`
	`44`	`+ if (length >= BLE_PREFERRED_MAX_MTU)`
	`45`	`+ {`
	`46`	`+ length = BLE_PREFERRED_MAX_MTU - 1; // Reserve space for null terminator`
	`47`	`+ }`
	`48`	`+`
`42`	`49`	`// Loop copy because memcpy isn't compatible with volatile`
`43`	`50`	`for (size_t buffer_index = 0; buffer_index < length; buffer_index++)`
`44`	`51`	`{`