From fd131a96a7bd686a591499f76a61cc9e5439c52b Mon Sep 17 00:00:00 2001 From: kappaone Date: Wed, 12 Aug 2026 16:13:48 +0300 Subject: [PATCH] fix(ble): reject negative and overlapping offsets in inbound write buffer A malicious BLE central can send ATT writes with a negative offset, which reaches Data.replaceSubrange via BLEInboundWriteBuffer.append and traps at runtime, crashing any peripheral that receives the write. Validate each chunk before mutating the buffer: reject negative offsets, non-monotonic sequences, and overlapping chunks, and drop the offending per-central buffer. Add an AppendResult.invalid case, handle it in the peripheral-role write handler, and cover the rejection paths with tests. --- .../Services/BLE/BLEInboundWriteBuffer.swift | 19 ++++ .../BLEService+LinkLayerPeripheralRole.swift | 5 + .../Services/BLEInboundWriteBufferTests.swift | 99 +++++++++++++++++++ 3 files changed, 123 insertions(+) diff --git a/bitchat/Services/BLE/BLEInboundWriteBuffer.swift b/bitchat/Services/BLE/BLEInboundWriteBuffer.swift index 155a16d6..8174f76c 100644 --- a/bitchat/Services/BLE/BLEInboundWriteBuffer.swift +++ b/bitchat/Services/BLE/BLEInboundWriteBuffer.swift @@ -18,6 +18,7 @@ struct BLEInboundWriteBuffer { case decoded(packet: BitchatPacket, metadata: BLEInboundWriteAppendMetadata) case waiting(metadata: BLEInboundWriteAppendMetadata) case oversized(metadata: BLEInboundWriteAppendMetadata) + case invalid(metadata: BLEInboundWriteAppendMetadata) } private var buffersByCentralID: [String: Data] = [:] @@ -34,10 +35,28 @@ struct BLEInboundWriteBuffer { var combined = buffersByCentralID[centralID] ?? Data() var appendedBytes = 0 var offsets: [Int] = [] + // New chunks must not overlap bytes already buffered for this central. + var lastEnd = combined.count for chunk in chunks where !chunk.data.isEmpty { offsets.append(chunk.offset) + + // Reject malformed writes before touching the buffer: a negative + // offset traps `Data.replaceSubrange`, and non-monotonic or + // overlapping offsets corrupt previously written bytes. + guard chunk.offset >= 0, chunk.offset >= lastEnd else { + let metadata = BLEInboundWriteAppendMetadata( + accumulatedBytes: combined.count, + appendedBytes: appendedBytes, + offsets: offsets, + packetType: combined.count >= 2 ? combined[1] : nil + ) + buffersByCentralID.removeValue(forKey: centralID) + return .invalid(metadata: metadata) + } + let end = chunk.offset + chunk.data.count + lastEnd = end if combined.count < end { combined.append(Data(repeating: 0, count: end - combined.count)) diff --git a/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift b/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift index c55c30e4..452db260 100644 --- a/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift +++ b/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift @@ -284,6 +284,11 @@ extension BLEService: CBPeripheralManagerDelegate { logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) SecureLogger.warning("⚠️ Dropping oversized pending write buffer (\(metadata.accumulatedBytes) bytes) for central \(centralUUID.prefix(8))…", category: .session) logFailedSingleWriteIfNeeded(hasMultiple: hasMultiple, sortedRequests: sorted) + + case let .invalid(metadata): + logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) + SecureLogger.warning("⚠️ Dropping malformed pending write (offsets=\(metadata.offsets)) for central \(centralUUID.prefix(8))…", category: .session) + logFailedSingleWriteIfNeeded(hasMultiple: hasMultiple, sortedRequests: sorted) } } } diff --git a/bitchatTests/Services/BLEInboundWriteBufferTests.swift b/bitchatTests/Services/BLEInboundWriteBufferTests.swift index 636e2abf..3e1fd44b 100644 --- a/bitchatTests/Services/BLEInboundWriteBufferTests.swift +++ b/bitchatTests/Services/BLEInboundWriteBufferTests.swift @@ -126,6 +126,105 @@ struct BLEInboundWriteBufferTests { } } + @Test + func appendRejectsNegativeOffsetAndClearsBuffer() throws { + var buffer = BLEInboundWriteBuffer() + _ = buffer.append( + chunks: [BLEInboundWriteChunk(offset: 0, data: Data(repeating: 0x01, count: 4))], + for: "central-1", + capBytes: 1024 + ) + + let result = buffer.append( + chunks: [BLEInboundWriteChunk(offset: -1, data: Data([0x02]))], + for: "central-1", + capBytes: 1024 + ) + + if case let .invalid(metadata) = result { + #expect(metadata.offsets == [-1]) + } else { + Issue.record("Expected negative offset to be rejected") + } + + // The poisoned buffer was cleared, so a clean full frame still decodes. + let packet = makePacket(timestamp: 0x123) + let frame = try #require(packet.toBinaryData(padding: false)) + let decoded = buffer.append( + chunks: [BLEInboundWriteChunk(offset: 0, data: frame)], + for: "central-1", + capBytes: 1024 + ) + + if case let .decoded(decodedPacket, _) = decoded { + #expect(decodedPacket.timestamp == packet.timestamp) + } else { + Issue.record("Expected clean frame to decode after invalid write reset the buffer") + } + } + + @Test + func appendRejectsOverlappingChunks() { + var buffer = BLEInboundWriteBuffer() + + let result = buffer.append( + chunks: [ + BLEInboundWriteChunk(offset: 0, data: Data(repeating: 0x01, count: 8)), + BLEInboundWriteChunk(offset: 4, data: Data(repeating: 0x02, count: 4)) + ], + for: "central-1", + capBytes: 1024 + ) + + if case let .invalid(metadata) = result { + #expect(metadata.offsets == [0, 4]) + } else { + Issue.record("Expected overlapping chunks to be rejected") + } + } + + @Test + func appendRejectsNonMonotonicChunks() { + var buffer = BLEInboundWriteBuffer() + + let result = buffer.append( + chunks: [ + BLEInboundWriteChunk(offset: 8, data: Data(repeating: 0x01, count: 4)), + BLEInboundWriteChunk(offset: 0, data: Data(repeating: 0x02, count: 4)) + ], + for: "central-1", + capBytes: 1024 + ) + + if case let .invalid(metadata) = result { + #expect(metadata.offsets == [8, 0]) + } else { + Issue.record("Expected non-monotonic chunks to be rejected") + } + } + + @Test + func appendRejectsOverlapWithPreviouslyBufferedBytes() { + var buffer = BLEInboundWriteBuffer() + _ = buffer.append( + chunks: [BLEInboundWriteChunk(offset: 0, data: Data(repeating: 0x01, count: 8))], + for: "central-1", + capBytes: 1024 + ) + + let result = buffer.append( + chunks: [BLEInboundWriteChunk(offset: 4, data: Data(repeating: 0x02, count: 4))], + for: "central-1", + capBytes: 1024 + ) + + if case let .invalid(metadata) = result { + #expect(metadata.offsets == [4]) + } else { + Issue.record("Expected overlap with buffered bytes to be rejected") + } + } + private func makePacket(timestamp: UInt64 = 0x0102030405) -> BitchatPacket { BitchatPacket( type: MessageType.message.rawValue,