src/winrtble/peripheral.rs (advertisement service-data parsing, ~L277-289) calls data.split_at(2), split_at(4), split_at(16) on service data sections without checking length.
Failure scenario: any nearby device advertising an AD structure of type 0x16/0x20/0x21 with a payload shorter than the UUID length causes a panic inside the WinRT Received callback. This either aborts at the FFI boundary or poisons the latest_service_data RwLock, after which properties()/Debug panic. Remotely triggerable crash of any scanning app.
Fix direction: skip (and trace-log) sections shorter than the UUID size, e.g. via split_at_checked.
src/winrtble/peripheral.rs(advertisement service-data parsing, ~L277-289) callsdata.split_at(2),split_at(4),split_at(16)on service data sections without checking length.Failure scenario: any nearby device advertising an AD structure of type 0x16/0x20/0x21 with a payload shorter than the UUID length causes a panic inside the WinRT
Receivedcallback. This either aborts at the FFI boundary or poisons thelatest_service_dataRwLock, after whichproperties()/Debugpanic. Remotely triggerable crash of any scanning app.Fix direction: skip (and trace-log) sections shorter than the UUID size, e.g. via
split_at_checked.