Repository navigation
fix(split): bounds check the source of a peripheral battery event - #3556
Open
akira-toriyama wants to merge 1 commit into
Open
akira-toriyama wants to merge 1 commit into
akira-toriyama wants to merge 1 commit into
Conversation
The BLE transport queues a battery event of level 0 for every disconnected connection, with the source from peripheral_slot_index_for_conn(), which returns -EINVAL for a connection that holds no peripheral slot. A host's disconnect therefore reaches the central's event handler with source 234, and peripheral_battery_levels[234] = 0 is written past the array. Check the source against ZMK_SPLIT_CENTRAL_PERIPHERAL_COUNT before the write, as zmk_split_central_get_peripheral_battery_level() does on the read side. Adds a BLE test in which a host connects to a split central that fetches and proxies the peripheral's battery level, then disconnects and reconnects: the central rejects the event with source 234 instead of passing it to the battery level proxy as an out-of-range event. Fixes zmkfirmware#3522 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With
CONFIG_ZMK_SPLIT_BLE_CENTRAL_BATTERY_LEVEL_FETCHING=y,split_central_disconnected()inapp/src/split/bluetooth/central.cqueues a battery event for every disconnected connection, with the source fromperipheral_slot_index_for_conn(), which returns-EINVALfor a connection that holds no peripheral slot. The handler inapp/src/split/central.cwritesperipheral_battery_levels[source]without a range check, so a host's disconnect writesperipheral_battery_levels[234](#3522).This adds the range check on the write side, matching
zmk_split_central_get_peripheral_battery_level(), and the BLE testapp/tests/ble/split/battery-level-host-disconnect: a host (-disconnect_and_reconnect) connects to a split central that fetches and proxies its peripheral's battery level, then disconnects and reconnects. The snapshot keeps the central's connection, battery and slot lines.Measured in
zmkfirmware/zmk-build-arm:4.1with./run-ble-test.sh tests/ble/split/battery-level-host-disconnect:main(4dd95d7) the test fails: after the host's disconnect the proxy logsGot battery level event for an out of range peripheral index;Ignoring battery event from out of range peripheral 234and the proxy gets no event. The peripheral's own level (Peripheral battery level event: 100) still goes through.Fixes #3522
PR check-list
app/tests/ble/splittests, which carry none)🤖 Generated with Claude Code