ble_mesh: stack: Apply the errata E16350 from Bluetooth SIG
@@ -840,6 +840,7 @@ static void prov_start(const uint8_t *data)
static void send_confirm(void)
{
+ uint8_t *local_conf = NULL;
PROV_BUF(cfm, 17);
BT_DBG("ConfInputs[0] %s", bt_hex(link.conf_inputs, 64));
@@ -872,13 +873,21 @@ static void send_confirm(void)
prov_buf_init(&cfm, PROV_CONFIRM);
+ local_conf = net_buf_simple_add(&cfm, 16);
+
if (bt_mesh_prov_conf(link.conf_key, link.rand, link.auth,
- net_buf_simple_add(&cfm, 16))) {
+ local_conf)) {
BT_ERR("Unable to generate confirmation value");
prov_send_fail_msg(PROV_ERR_UNEXP_ERR);
return;
}
+ if (!memcmp(link.conf, local_conf, 16)) {
+ BT_ERR("Confirmation value is identical to ours, rejecting.");
+ prov_send_fail_msg(PROV_ERR_NVAL_FMT);
+ return;
+ }
+
if (prov_send(&cfm)) {
BT_ERR("Unable to send Provisioning Confirm");
return;
