nimble/ll: Verify length of Terminate Ind
Make sure Terminate ind has correct len. Otherwise do not procced but
reply with LL_UNKNOWN_RSP
This should fix LL/PAC/SLA/BI-01 and LL/PAC/MAS/BI-01
@@ -3907,7 +3907,8 @@ chk_rx_terminate_ind:
}
/* If we received a terminate IND, we must set some flags */
- if (is_ctrl && (opcode == BLE_LL_CTRL_TERMINATE_IND)) {
+ if (is_ctrl && (opcode == BLE_LL_CTRL_TERMINATE_IND)
+ && (rx_pyld_len == BLE_LL_CTRL_TERMINATE_IND_LEN)) {
connsm->csmflags.cfbit.terminate_ind_rxd = 1;
connsm->rxd_disconnect_reason = rxbuf[3];
reply = 1;
