commit 321dc0b999a1a8ba4ce19ada17056c1e2c534ea7
author Rahul <79141360+rahult-github@users.noreply.github.com> Thu Oct 09 19:52:03 2025 +0530
committer GitHub <noreply@github.com> Thu Oct 09 16:22:03 2025 +0200
tree 525a359f6fcd26ca55dd3cfe939b540877cffdc2
parent b7590dc3499f6b1da45dc41bb2f05a4d6122d753

porting: Fix buffer copy for mbuf in different pools

Given a chain of at least 2 mbufs, of which the mbufs come from more
than one pool of different-sized buffers and the first mbuf is smaller
in size than at least one of the rest, the memcpy() in os_mbuf_dup()
will write beyond the limits of the allocated mbuf.

This is because os_mbuf_dup() assumes all mbufs in a chain come from
the same pool as the first mbuf in the chain. Fixed the same.

porting/nimble/src/os_mbuf.c

diff --git a/porting/nimble/src/os_mbuf.c b/porting/nimble/src/os_mbuf.c
index 829d798..93126c6 100644
--- a/porting/nimble/src/os_mbuf.c
+++ b/porting/nimble/src/os_mbuf.c
@@ -384,12 +384,13 @@
     struct os_mbuf *head;
     struct os_mbuf *copy;
 
-    omp = om->om_omp;
-
     head = NULL;
     copy = NULL;
 
     for (; om != NULL; om = SLIST_NEXT(om, om_next)) {
+
+        omp = om->om_omp;
+
         if (head) {
             SLIST_NEXT(copy, om_next) = os_mbuf_get(omp,
                     OS_MBUF_LEADINGSPACE(om));