fix(ble_mesh): index last_param by inst_type, not controller inst_id

last_param[] is sized by BLE_MESH_ADV_INST_TYPES_NUM (the number of mesh
advertising instance types) but was indexed by inst_id, the controller
advertising instance id (Kconfig range 0-3). With multi-adv disabled the
type count is 1, so any non-zero CONFIG_BLE_MESH_ADV_INST_ID caused an
out-of-bounds access into last_param[].

Map inst_id to inst_type with the new bt_mesh_get_adv_inst_type_by_inst_id()
helper and index last_param by inst_type in both the nimble and bluedroid
host adapters. Add a bounds check at bt_le_ext_adv_start() entry to guard
against unmapped instance ids.

components/bt/esp_ble_mesh/core/adv_common.c

@@ -146,6 +146,16 @@ static struct bt_mesh_adv_inst adv_insts[] = {
 #endif /* CONFIG_BLE_MESH_SUPPORT_MULTI_ADV */
 };
 
+enum bt_mesh_adv_inst_type bt_mesh_get_adv_inst_idx_by_inst_id(uint8_t inst_id)
+{
+    for (int i = 0; i < ARRAY_SIZE(adv_insts); i++) {
+        if (adv_insts[i].id == inst_id) {
+            return i;
+        }
+    }
+    return BLE_MESH_ADV_INST_TYPES_NUM;
+}
+
 static struct bt_mesh_adv_inst *find_adv_inst_with_inst_id(uint8_t id)
 {
     BT_DBG("FindAdvInstWithID, InstID %u", id);

components/bt/esp_ble_mesh/core/adv_common.h

@@ -263,6 +263,8 @@ struct bt_mesh_adv_inst *bt_mesh_get_adv_insts_set(void);
 
 bool bt_mesh_is_adv_inst_used(uint8_t inst_id);
 
+enum bt_mesh_adv_inst_type bt_mesh_get_adv_inst_idx_by_inst_id(uint8_t inst_id);
+
 int bt_mesh_adv_inst_init(enum bt_mesh_adv_inst_type inst_type, uint8_t inst_id);
 
 int bt_mesh_adv_inst_deinit(enum bt_mesh_adv_inst_type inst_type);

components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c

@@ -22,6 +22,7 @@
 #include "mesh/common.h"
 #include "prov_pvnr.h"
 #include "scan.h"
+#include "adv_common.h"
 #include "net.h"
 #include "beacon.h"
 #include "btc_ble_mesh_ble.h"
@@ -671,6 +672,13 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
     tBTA_DM_BLE_EXT_ADV ext_adv = {0};
     uint16_t interval = 0U;
     int err = 0;
+    enum bt_mesh_adv_inst_type inst_type =
+        bt_mesh_get_adv_inst_idx_by_inst_id(inst_id);
+
+    if (inst_type >= BLE_MESH_ADV_INST_TYPES_NUM) {
+        BT_ERR("Invalid adv inst id %u", inst_id);
+        return -EINVAL;
+    }
 
     assert(param);
 
@@ -746,17 +754,17 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
     ext_adv_params.interval_min = interval;
     ext_adv_params.interval_max = interval;
 
-    if (memcmp(&ext_adv_params, &last_param[inst_id].param, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS))) {
-        if (last_param[inst_id].set) {
+    if (memcmp(&ext_adv_params, &last_param[inst_type].param, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS))) {
+        if (last_param[inst_type].set) {
             BTA_DmBleGapExtAdvSetRemove(inst_id);
         }
 
-        last_param[inst_id].set = true;
+        last_param[inst_type].set = true;
 
         /* Check if we can start adv using BTM_BleSetAdvParamsStartAdvCheck */
         BTA_DmBleGapExtAdvSetParams(inst_id, &ext_adv_params);
 
-        memcpy(&last_param[inst_id].param, &ext_adv_params, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS));
+        memcpy(&last_param[inst_type].param, &ext_adv_params, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS));
     }
 
     err = set_adv_data(BLE_MESH_HCI_OP_SET_ADV_DATA, inst_id, ad, ad_len);

components/bt/esp_ble_mesh/core/nimble_host/adapter.c

@@ -20,6 +20,7 @@
 #include "mesh/common.h"
 #include "prov_pvnr.h"
 #include "scan.h"
+#include "adv_common.h"
 #include "btc_ble_mesh_ble.h"
 
 /** @def BT_UUID_MESH_PROV
@@ -1184,6 +1185,13 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
     uint16_t interval = 0;
     uint8_t buf_len = 0;
     int err = 0;
+    enum bt_mesh_adv_inst_type inst_type =
+        bt_mesh_get_adv_inst_idx_by_inst_id(inst_id);
+
+    if (inst_type >= BLE_MESH_ADV_INST_TYPES_NUM) {
+        BT_ERR("Invalid adv inst id %u", inst_id);
+        return -EINVAL;
+    }
 
     err = ble_gap_ext_adv_active(inst_id);
     if (err) {
@@ -1310,9 +1318,9 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
     adv_params.itvl_min = interval;
     adv_params.itvl_max = interval;
 
-    if (memcmp(&adv_params, &last_param[inst_id].param,
+    if (memcmp(&adv_params, &last_param[inst_type].param,
         sizeof(struct ble_gap_ext_adv_params))) {
-        if (last_param[inst_id].set) {
+        if (last_param[inst_type].set) {
             err = ble_gap_ext_adv_remove(inst_id);
             if (err != 0 && err != BLE_HS_EALREADY) {
                 BT_ERR("Advertising rm failed: err %d", err);
@@ -1323,7 +1331,7 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
                 return err;
             }
         }
-        last_param[inst_id].set = true;
+        last_param[inst_type].set = true;
         err = ble_gap_ext_adv_configure(inst_id, &adv_params, NULL, gap_event_cb, NULL);
         if (err != 0) {
             BT_ERR("Advertising config failed: err %d", err);
@@ -1334,7 +1342,7 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
             return err;
         }
 
-        memcpy(&last_param[inst_id].param, &adv_params, sizeof(struct ble_gap_ext_adv_params));
+        memcpy(&last_param[inst_type].param, &adv_params, sizeof(struct ble_gap_ext_adv_params));
     }
 
     err = ble_gap_ext_adv_set_data(inst_id, data);