Skip to content

[Fix] Fix webOS's bluetooth overflow problem#71761

Open
jungwook-park wants to merge 1 commit intoproject-chip:masterfrom
jungwook-park:fix-webos-overflow
Open

[Fix] Fix webOS's bluetooth overflow problem#71761
jungwook-park wants to merge 1 commit intoproject-chip:masterfrom
jungwook-park:fix-webos-overflow

Conversation

@jungwook-park
Copy link
Copy Markdown
Contributor

@jungwook-park jungwook-park commented Apr 24, 2026

Summary

  • Fix potential stack buffer overflow in webOS BLE scanner when parsing oversized Matter advertisement data.The _HexToBytes() function did not properly validate the length of attacker-controlled serviceData, which could lead to out-of-bounds stack write.
  • This fix prevents potential remote code execution (RCE) or denial-of-service (DoS) attacks that could be triggered by broadcasting specially crafted, oversized BLE advertisement packets

Related issues

Fixes #71760

Testing

Manually verified rejection of oversized serviceData and confirmed normal Matter BLE advertisements are still parsed correctly.

Readability checklist

The checklist below will help the reviewer finish PR review in time and keep the
code readable:

  • PR title is descriptive
  • Apply the “When in Rome…” rule (coding style)
  • PR size is short
  • Try to avoid "squashing" and "force-update" in commit history
  • CI time didn't increase

@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the _HexToBytes function in WbsDeviceScanner.cpp to include destination size validation and ensure the output buffer is zero-initialized for unused bytes. Feedback suggests optimizing the implementation by decoding directly into the destination buffer, thereby eliminating unnecessary heap allocation and memory copying. Additionally, the reviewer noted that braces should be used for all if statements to maintain consistency with the existing codebase style.

Comment thread src/platform/webos/wbs/WbsDeviceScanner.cpp Outdated
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 24, 2026

PR #71761: Size comparison from adb9376 to 3939be3

Full report (6 builds for cc32xx, nrfconnect, realtek, stm32)
platform target config section adb9376 3939be3 change % change
cc32xx air-purifier CC3235SF_LAUNCHXL FLASH 562722 562722 0 0.0
RAM 205072 205072 0 0.0
lock CC3235SF_LAUNCHXL FLASH 594586 594586 0 0.0
RAM 205272 205272 0 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 FLASH 866632 866632 0 0.0
RAM 162404 162404 0 0.0
realtek light-switch-app rtl8777g FLASH 682856 682856 0 0.0
RAM 101824 101824 0 0.0
lighting-app rtl8777g FLASH 726760 726760 0 0.0
RAM 102164 102164 0 0.0
stm32 light STM32WB5MM-DK FLASH 477348 477348 0 0.0
RAM 141604 141604 0 0.0

Comment thread src/platform/webos/wbs/WbsDeviceScanner.cpp Outdated
Comment thread src/platform/webos/wbs/WbsDeviceScanner.cpp Outdated
@jungwook-park jungwook-park force-pushed the fix-webos-overflow branch 2 times, most recently from 3e63f7d to 2faa263 Compare April 28, 2026 01:07
detailed:
 Prevent overflow lisk
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 28, 2026

PR #71761: Size comparison from 6bf5656 to 2428d8a

Full report (34 builds for bl602, bl616, bl702, bl702l, cc13x4_26x4, cc32xx, efr32, esp32, nrfconnect, nxp, psoc6, qpg, realtek, stm32, telink)
platform target config section 6bf5656 2428d8a change % change
bl602 lighting-app bl602+mfd+littlefs+rpc FLASH 1090734 1090734 0 0.0
RAM 144930 144930 0 0.0
bl616 lighting-app bl616+thread FLASH 1102236 1102236 0 0.0
RAM 104344 104344 0 0.0
bl616+wifi+shell FLASH 1589180 1589180 0 0.0
RAM 98240 98240 0 0.0
bl702 lighting-app bl702+eth FLASH 1053904 1053904 0 0.0
RAM 108549 108549 0 0.0
bl702l contact-sensor-app bl702l+mfd+littlefs FLASH 892608 892608 0 0.0
RAM 105940 105940 0 0.0
cc13x4_26x4 lighting-app LP_EM_CC1354P10_6 FLASH 776024 776024 0 0.0
RAM 103492 103492 0 0.0
lock-ftd LP_EM_CC1354P10_6 FLASH 788580 788580 0 0.0
RAM 108684 108684 0 0.0
pump-app LP_EM_CC1354P10_6 FLASH 735708 735708 0 0.0
RAM 97516 97516 0 0.0
pump-controller-app LP_EM_CC1354P10_6 FLASH 717756 717756 0 0.0
RAM 97644 97644 0 0.0
cc32xx air-purifier CC3235SF_LAUNCHXL FLASH 562722 562722 0 0.0
RAM 205072 205072 0 0.0
lock CC3235SF_LAUNCHXL FLASH 594586 594586 0 0.0
RAM 205272 205272 0 0.0
efr32 lock-app BRD4187C FLASH 993412 993412 0 0.0
RAM 131352 131352 0 0.0
BRD4338a FLASH 797645 797637 -8 -0.0
RAM 243452 243452 0 0.0
window-app BRD4187C FLASH 1099220 1099220 0 0.0
RAM 130392 130392 0 0.0
esp32 all-clusters-app c3devkit DRAM 99164 99164 0 0.0
FLASH 1607414 1607414 0 0.0
IRAM 94776 94776 0 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 FLASH 866652 866652 0 0.0
RAM 162404 162404 0 0.0
nxp contact mcxw71+release FLASH 742664 742664 0 0.0
RAM 67160 67160 0 0.0
psoc6 all-clusters cy8ckit_062s2_43012 FLASH 1717716 1717716 0 0.0
RAM 214628 214628 0 0.0
all-clusters-minimal cy8ckit_062s2_43012 FLASH 1615116 1615116 0 0.0
RAM 211500 211500 0 0.0
light cy8ckit_062s2_43012 FLASH 1469428 1469428 0 0.0
RAM 197548 197548 0 0.0
lock cy8ckit_062s2_43012 FLASH 1502404 1502404 0 0.0
RAM 225276 225276 0 0.0
qpg lighting-app qpg6200+debug FLASH 843068 843068 0 0.0
RAM 127956 127956 0 0.0
lock-app qpg6200+debug FLASH 781644 781644 0 0.0
RAM 118904 118904 0 0.0
realtek light-switch-app rtl8777g FLASH 684680 684680 0 0.0
RAM 101832 101832 0 0.0
lighting-app rtl8777g FLASH 728728 728728 0 0.0
RAM 102164 102164 0 0.0
stm32 light STM32WB5MM-DK FLASH 477348 477348 0 0.0
RAM 141604 141604 0 0.0
telink bridge-app tl7218x FLASH 730678 730678 0 0.0
RAM 95932 95932 0 0.0
light-app-ota-compress-lzma-shell-factory-data tl3218x FLASH 850378 850378 0 0.0
RAM 44400 44400 0 0.0
tl7218x FLASH 841784 841784 0 0.0
RAM 99796 99796 0 0.0
light-switch-app-ota-compress-lzma-factory-data tl7218x_retention FLASH 730300 730300 0 0.0
RAM 56064 56064 0 0.0
light-switch-app-ota-compress-lzma-shell-factory-data tlsr9528a FLASH 793526 793526 0 0.0
RAM 75248 75248 0 0.0
light-switch-app-ota-factory-data tl3218x_retention FLASH 730198 730198 0 0.0
RAM 33544 33544 0 0.0
lighting-app-ota-factory-data tlsr9118bdk40d FLASH 613126 613126 0 0.0
RAM 118632 118632 0 0.0
lighting-app-ota-rpc-factory-data-4mb tlsr9518adk80d FLASH 839898 839902 4 0.0
RAM 97504 97504 0 0.0

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 28, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.52%. Comparing base (c0a7297) to head (2428d8a).
⚠️ Report is 39 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #71761      +/-   ##
==========================================
+ Coverage   54.50%   54.52%   +0.02%     
==========================================
  Files        1588     1588              
  Lines      112392   108572    -3820     
  Branches    13521    13365     -156     
==========================================
- Hits        61264    59204    -2060     
+ Misses      51128    49368    -1760     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Potential stack buffer overflow in webOS When parsing BLE Matter advertising

3 participants