Skip to content

WinRT: short service-data advertisement sections panic in scan callback #482

Description

@qdot

src/winrtble/peripheral.rs (advertisement service-data parsing, ~L277-289) calls data.split_at(2), split_at(4), split_at(16) on service data sections without checking length.

Failure scenario: any nearby device advertising an AD structure of type 0x16/0x20/0x21 with a payload shorter than the UUID length causes a panic inside the WinRT Received callback. This either aborts at the FFI boundary or poisons the latest_service_data RwLock, after which properties()/Debug panic. Remotely triggerable crash of any scanning app.

Fix direction: skip (and trace-log) sections shorter than the UUID size, e.g. via split_at_checked.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinguwp (windows)Issues related to the UWP/Win10 core

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions