search

espressif / esp-nimble

A fork of NimBLE stack, for use with ESP32 and ESP-IDF
Apache License 2.0
76 stars 49 forks source link

ble_rpa_resolv_add_peer_rec can iterate past the end of peer_dev_rec array #36

Closed stevegrau-ayla closed 5 months ago

stevegrau-ayla commented 2 years ago

idx starts at 0 while p_dev_rec starts at what is supposed to be the first unused entry in the array. The check of idx to return if the array is full doesn't take into account that the iteration may not have started at array element 0.

It isn't clear why p_dev_rec->rec_used is even needed. The strategy when deleting entries is to block copy remaining entries in the array over the deleted entry, keeping the used entries packed at the beginning of the array. The next unused entry should always be at ble_store_num_per_dev_rec, if the array isn't full.

Singh-Sumeet commented 5 months ago

Hi, this issue was addressed and fixed in this commit: 1.5.0 - f4bb8b563f8a08ff9ad609bd619e7ea562765397 (Bugfix: Fix incomplete clearing of peer_dev_rec) 1.4.0 - 2412a15acc9cf250f25f541b21ef0edeb1d22fae (Bugfix: Fix incomplete clearing of peer_dev_rec) 1.3.0 - 99a79e4aec8a7d239d6fd9152d12f21e73c592cf (Bugfix: Fix incomplete clearing of peer_dev_rec)