Cordio BLE: Fix integer overflows (CVE-2024-48983)

[Diff-fusion]

Summary of changes

hciTrSerialRxIncoming parses incoming hci packets. In doing so, it dynamically determines the length of the packet body. For the case of HCI_ACL_TYPE this is done by reading 2 bytes from the packet header.

mbed-os/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c

Lines 182 to 195 in 54e8693

	switch (pktIndRx)
	{
	case HCI_CMD_TYPE:
	dataLen = hdrRx[2];
	break;
	case HCI_ACL_TYPE:
	BYTES_TO_UINT16(dataLen, &hdrRx[2]);
	break;
	case HCI_EVT_TYPE:
	dataLen = hdrRx[1];
	break;
	default:
	break;
	}

A buffer is then allocated to hold the packet, the length of which is determined by the sum of this 16bit integer and the length of the packet header.

mbed-os/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c

Lines 197 to 201 in 54e8693

	/* allocate data buffer to hold entire packet */
	if (pktIndRx == HCI_ACL_TYPE)
	{
	pPktRx = (uint8_t*)WsfMsgDataAlloc(hdrLen + dataLen, 0);
	}

The final buffer size is also increased by WsfMsgAlloc, which adds the size of one wsfMsg_t.

mbed-os/connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c

Line 72 in 54e8693

pMsg = WsfBufAlloc(len + sizeof(wsfMsg_t));

For large dataLen values, this addition may result in an integer overflow which causes the allocated buffer to be very small. Header and body are then copied separately, resulting in one operation of size hdrLen and one of size dataLen, the latter of which is always larger than the allocated buffer. This leads to a buffer overflow which, if large amounts of data are written, will likely result in corruption of memory data and may cause the system to crash.

This fix eliminates the issue by check for integer overflows, both in hciTrSerialRxIncoming and WsfMsgAlloc.

Impact of changes

Migration actions required

Documentation

None

---

Pull request type

[x] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[] Feature update (New feature / Functionality change / New API)
[] Major update (Breaking change E.g. Return code change / API behaviour change)

---

Test results

[] No Tests required for this change (E.g docs only update)
[x] Covered by existing mbed-os tests (Greentea or Unittest)
[] Tests / results supplied as part of this PR

---

[Diff-fusion]

This PR fixes CVE-2024-48983

[multiplemonomials]

Thanks for the fix!