Skip to content

Conversation

@cwklurks
Copy link

Hi! First-time contributor here, and I'm a high-school rower as well. I found two bugs in the FTMS control point characteristic while reading through the BLE implementation and wanted to fix them.

Bugs Fixed

1. stopOrPause never responds on invalid parameter

When stopOrPause receives a controlParameter other than 1 (stop) or 2 (pause), the error is
logged but the BLE callback is never called. This leaves the connected app hanging indefinitely with no
response.

Fix: Return invalidParameter (0x03) for values outside {1, 2}, and validate the parameter byte
is present in the buffer.

2. setIndoorBikeSimulationParameters bypasses requestControl check

All other commands go through handleSimpleCommand, which enforces the controlled state.
setIndoorBikeSimulationParameters skips this and invokes the callback directly, succeeding without a
prior requestControl call. This violates the FTMS spec.

Fix: New handleSimParameters method that checks controlled state and returns
controlNotPermitted (0x05) when appropriate. Also adds buffer length validation (requires 7 bytes) to
prevent out-of-bounds reads on truncated payloads.

Test Coverage

Added 23 tests for FitnessMachineControlPointCharacteristic covering:

  • Full requestControl -> controlled state machine
  • All 5 implemented opCodes
  • Both bug fixes
  • Edge cases (truncated buffers, boundary values, unknown opcodes)

Uses Node's module.register() to mock @abandonware/bleno without additional dependencies.

Notes

  • No changes to public API or behavior for valid inputs
  • Both bugs only affect error/edge-case paths
  • Tested with npm test - all existing and new tests pass

cwklurks and others added 3 commits February 12, 2026 09:17
…nParameters

- Fix stopOrPause with invalid parameter now returns invalidParameter response instead of hanging BLE stack
- Fix setIndoorBikeSimulationParameters now requires requestControl like other commands
- stopOrPause with invalid param returns invalidParameter instead of
  silently dropping (prevents BLE stack hang)
- setIndoorBikeSimulationParameters now requires requestControl first
- add buffer length validation to prevent crashes on truncated packets
- add 4 edge case tests for malformed packets and invalid params
fix(ble): FTMS control point bug fixes and buffer validation
@Abasz
Copy link

Abasz commented Feb 12, 2026

Hi, this repo is dead, use this fork instead:

https://github.com/JaapvanEkris/openrowingmonitor

Its being actively developed and years ahead of this including full BLE protocol rewrite (including stack, profiles and communication layer).

Thanks

@cwklurks
Copy link
Author

Ah, I was wondering about that. I forked the wrong one. I'll see what changes I can help with on the updated repo. thank u!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants