From b54bd2452e96ec666010c5ceeea7a6f5439988ad Mon Sep 17 00:00:00 2001 From: Dereck Date: Tue, 5 May 2026 00:07:35 -0400 Subject: [PATCH] fix buffer overread in get_feature_data l2cap_send was passed the caller's `len` (expected response size) instead of the actual array size. The get_feature array is only 2 bytes (transaction header + report ID), so this read up to 62 bytes of uninitialized stack. Use sizeof(get_feature) to send only the 2-byte GET_REPORT request. --- src/bt.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/bt.cpp b/src/bt.cpp index 1d90494..a1de365 100644 --- a/src/bt.cpp +++ b/src/bt.cpp @@ -487,7 +487,7 @@ vector get_feature_data(uint8_t reportId, uint16_t len) { if (!feature_data.contains(reportId) || reportId == 0x81) { if (hid_control_cid != 0) { uint8_t get_feature[] = {0x43, reportId}; - l2cap_send(hid_control_cid, get_feature, len); + l2cap_send(hid_control_cid, get_feature, sizeof(get_feature)); printf("[L2CAP] Requesting Get Feature Report 0x%02X\n", reportId); } }