dbinfrago / dbinfrago/libpax

Logical error in blescan.cpp

Open
#32 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
35
Forks
21
PR merge metrics
No merged PRs in 30d

Description

The block with error:

```cpp
if (sub_event == HCI_LE_ADV_REPORT) {
// get number of advertising reports
num_responses = queue_data[data_ptr++];

// skip 2 bytes event type and advertising type for every report
data_ptr += 2 * num_responses;

// get device address in every advertising report and
// store in array of length `6 * num_responses' as each record
// contains 6 octets
// -> note: BD addresses are stored in little endian format!
// see # Bluetooth Specification v5.0, Vol 2, Part E, sec 5.2
addr = (uint8_t *)malloc(sizeof(uint8_t) * 6 * num_responses);
if (addr == NULL) {
ESP_LOGE(TAG, "Malloc addr failed");
goto reset;
}
for (int i = 0; i < num_responses; i += 1) {
for (int j = 5; j >= 0; j -= 1) {
addr[(6 * i) + j] = queue_data[data_ptr++];
}
}

// get length of data for each advertising report
for (uint8_t i = 0; i < num_responses; i += 1) {
total_data_len += queue_data[data_ptr++];
}

// skip all data packets
data_ptr += total_data_len;

// Count each advertising report within rssi threshold
for (uint8_t i = 0; i < num_responses; i += 1) {
rssi = -(0xFF - queue_data[data_ptr++]);
if (ble_rssi_threshold && (rssi < ble_rssi_threshold))
continue; // do not count weak signal mac
else {
mac_add(addr + 6 * i, MAC_SNIFF_BLE);
}
}

// freeing all spaces allocated
reset:
free(addr);
}
```

True reports structure is
```
Num
ET0 AT0 Addr0[6] Len0 Data0[...] RSSI0
ET1 AT1 Addr1[6] Len1 Data1[...] RSSI1
...
```

but your code does this
```cpp
// skip 2 bytes event type and advertising type for every report
data_ptr += 2 * num_responses;
....
addr[(6 * i) + j] = queue_data[data_ptr++]; - shift pointer in loop
....
total_data_len += queue_data[data_ptr++]; - shift pointer in loop
.....
// skip all data packets
data_ptr += total_data_len;
.....
rssi = -(0xFF - queue_data[data_ptr++]); - again shift pointer in loop
```

Your code works only when advertisement packet is ONE! When chip report several packets you read like for columns and it is wrong. You will forward for wrong shifts and will got memory errors and finally reset.

I assume you have become a victim of this stackoverflow:
https://stackoverflow.com/questions/26275679/ble-hci-le-advertising-report-event-data-format
But it is WRONG!

The truth is here:
https://www.spinics.net/lists/linux-bluetooth/msg78755.html

`
See Vol 2, Part E, section 5.2 (page 728 in the pdf):

• Arrayed parameters are specified using the following notation: ParameterA[i]. If more than one set of arrayed parameters are specified (e.g. ParameterA[i], ParameterB[i]), then, unless noted otherwise, the order of the parameters are as follows: ParameterA[0], ParameterB[0], ParameterA[1], ParameterB[1], ParameterA[2], ParameterB[2], ... ParameterA[n], ParameterB[n]

`

Correct info in https://www.mouser.it/pdfdocs/bluetooth-Core-v50.pdf (Vol 2, Part E, section 5.2, page 728)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.