Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt): Fix the critical issues related to HFP from AI review report

Browse Source 
HFP AG:
- Fix mSBC EV3 second-packet payload length calculation to prevent OOB read and infinite loop
- Add init/deinit guards in HF AG helper functions to avoid NULL deref
- Return bt_status_t from btc_hf_ag_audio_data_send to avoid silent buffer leak on SLC failure
- Break SCO CI data loop when SCO is not open to prevent CPU starvation
- Guard BTM_FreeSCN(0) and reset SCN after free in bta_ag_del_records
- Use OI_UINT32 for mSBC decode frame length to avoid stack corruption
- Bound AT Dial command string copy to BTA_AG_AT_MAX_LEN
HFP Client:
- Check osi_calloc result before use when reassembling split mSBC frames
- Use OI_UINT32 for mSBC decode frame length to avoid stack corruption
- Free SDP db, collision/AT timers and queued AT cmds before scb reset on disable
- Fix mSBC EV3 second-packet payload length calculation (same as AG)
- Reject pcm_resample input smaller than overlap window (96 bytes) on filtered path
- Break SCO CI data loop when SCO is not open to prevent CPU starvation
- Guard BTM_FreeSCN(0) and reset SCN after free in bta_hf_client_del_record
This commit is contained in:
yangfeng
2026-06-23 19:36:16 +08:00
parent ad1912642a
commit 0211122300
12 changed files with 82 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/api/esp_hf_ag_api.c
+1 -1
View File
@@ -651,7 +651,7 @@ esp_err_t esp_hf_ag_audio_data_send(esp_hf_sync_conn_hdl_t sync_conn_hdl, esp_hf
return ESP_ERR_INVALID_ARG;
}
if (btc_hf_ag_audio_data_send(sync_conn_hdl, (uint8_t *)audio_buf, audio_buf->data, audio_buf->data_len)) {
if (btc_hf_ag_audio_data_send(sync_conn_hdl, (uint8_t *)audio_buf, audio_buf->data, audio_buf->data_len) == BT_STATUS_SUCCESS) {
return ESP_OK;
}
return ESP_FAIL;