Skip to content

bluetooth: parse every advertising set in Set_Extended_Advertise_Enable - #5094

Open
mmadersbacher wants to merge 1 commit into
secdev:masterfrom
mmadersbacher:bluetooth-adv-sets
Open

bluetooth: parse every advertising set in Set_Extended_Advertise_Enable#5094
mmadersbacher wants to merge 1 commit into
secdev:masterfrom
mmadersbacher:bluetooth-adv-sets

Conversation

@mmadersbacher

Copy link
Copy Markdown
Contributor

HCI_Cmd_LE_Set_Extended_Advertise_Enable.sets returns a single entry no matter what num_sets says.

Extended_Advertise_Set does not override extract_padding, so the first set claims the following sets as its payload and PacketListField finds nothing left to parse.

>>> p = HCI_Cmd_LE_Set_Extended_Advertise_Enable(hex_bytes("01020164000502c8000a"))
>>> p.num_sets, len(p.sets)
(2, 1)
>>> bytes(p.sets[0].payload)
b'\x02\xc8\x00\n'

After the change len(p.sets) == 2 and the second set reads handle=2 duration=200 max_events=10. Rebuilding returns the same bytes either way. HCI_LE_Meta_Extended_Advertising_Report already carries the same extract_padding further down the module.

Validated on Windows with Python 3.13. UTscapy -t test/scapy/layers/bluetooth.uts gives 90 passed, 0 failed, with two cases added for two sets and one set. flake8 scapy/ and mypy_check.py (win32 and linux) are clean. The full windows.utsc campaign gives 96 failures, the same count and the same files as on master, all unrelated and caused by missing tcpdump, tshark and libpcap here.

Extended_Advertise_Set does not override extract_padding, so the first
set claims the remaining sets as its payload and PacketListField stops
after one entry. A command with num_sets=2 dissected into len(sets)==1,
with the second set left in sets[0].payload as Raw.

HCI_LE_Meta_Extended_Advertising_Report already does this in the same
module.

AI-Assisted: yes (Claude Code)
@codecov

codecov Bot commented Aug 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.78%. Comparing base (1f87020) to head (23269e2).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5094      +/-   ##
==========================================
+ Coverage   79.42%   79.78%   +0.35%     
==========================================
  Files         372      372              
  Lines       96507    96562      +55     
==========================================
+ Hits        76652    77042     +390     
+ Misses      19855    19520     -335     
Files with missing lines Coverage Δ
scapy/layers/bluetooth.py 90.84% <100.00%> (+0.01%) ⬆️

... and 41 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants