Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete

Browse Source
This commit is contained in:
Jin Cheng
2025-12-19 11:20:20 +08:00
parent 89dbbc6f37
commit 4a5656b964
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_sec.c
+7 -2
View File
@@ -2753,11 +2753,16 @@ static void btm_sec_bond_cancel_complete (void)
** Returns void ** Returns void
** **
*******************************************************************************/ *******************************************************************************/
void btm_create_conn_cancel_complete (UINT8 *p) void btm_create_conn_cancel_complete (UINT8 *p, UINT16 evt_len)
{ {
UINT8 status; UINT8 status;
STREAM_TO_UINT8 (status, p); if (evt_len >= 1) {
STREAM_TO_UINT8 (status, p);
} else {
BTM_TRACE_ERROR("%s malformatted event packet, too short", __func__);
status = BTM_ERR_PROCESSING;
}
//BTM_TRACE_EVENT ("btm_create_conn_cancel_complete(): in State: %s status:%d\n", //BTM_TRACE_EVENT ("btm_create_conn_cancel_complete(): in State: %s status:%d\n",
// btm_pair_state_descr(btm_cb.pairing_state), status); // btm_pair_state_descr(btm_cb.pairing_state), status);
components/bt/host/bluedroid/stack/btm/include/btm_int.h
+1 -1
View File
@@ -1215,7 +1215,7 @@ tBTM_STATUS btm_sec_mx_access_request (BD_ADDR bd_addr, UINT16 psm, BOOLEAN is_
UINT32 mx_proto_id, UINT32 mx_chan_id, UINT32 mx_proto_id, UINT32 mx_chan_id,
tBTM_SEC_CALLBACK *p_callback, void *p_ref_data); tBTM_SEC_CALLBACK *p_callback, void *p_ref_data);
void btm_sec_conn_req (UINT8 *bda, UINT8 *dc); void btm_sec_conn_req (UINT8 *bda, UINT8 *dc);
void btm_create_conn_cancel_complete (UINT8 *p); void btm_create_conn_cancel_complete (UINT8 *p, UINT16 evt_len);
void btm_read_linq_tx_power_complete (UINT8 *p); void btm_read_linq_tx_power_complete (UINT8 *p);
void btm_sec_init (UINT8 sec_mode); void btm_sec_init (UINT8 sec_mode);
components/bt/host/bluedroid/stack/btu/btu_hcif.c
+1 -1
View File
@@ -1165,7 +1165,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
break; break;
#if (CLASSIC_BT_INCLUDED == TRUE) #if (CLASSIC_BT_INCLUDED == TRUE)
case HCI_CREATE_CONNECTION_CANCEL: case HCI_CREATE_CONNECTION_CANCEL:
btm_create_conn_cancel_complete(p); btm_create_conn_cancel_complete(p, evt_len);
break; break;
#endif // #if (CLASSIC_BT_INCLUDED == TRUE) #endif // #if (CLASSIC_BT_INCLUDED == TRUE)
case HCI_READ_LOCAL_OOB_DATA: case HCI_READ_LOCAL_OOB_DATA: