Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed the vulerabilities from AI code review in SPP

Browse Source
This commit is contained in:
Jin Cheng
2026-03-24 20:27:23 +08:00
committed by Jin Cheng
parent eb1c77472a
commit 51cf9d7b46
17 changed files with 133 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
components/bt/host/bluedroid/api/esp_spp_api.c
View File

@@ -18,7 +18,6 @@
static const uint8_t UUID_SPP[16] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00,
0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
};
static tSDP_UUID sdp_uuid;
esp_err_t esp_spp_register_callback(esp_spp_cb_t callback)
{
@@ -50,8 +49,8 @@ esp_err_t esp_spp_enhanced_init(const esp_spp_cfg_t *cfg)
btc_spp_args_t arg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (cfg->mode == ESP_SPP_MODE_VFS && (cfg->tx_buffer_size < ESP_SPP_MIN_TX_BUFFER_SIZE ||
cfg->tx_buffer_size > ESP_SPP_MAX_TX_BUFFER_SIZE)) {
if (!cfg || (cfg->mode == ESP_SPP_MODE_VFS && (cfg->tx_buffer_size < ESP_SPP_MIN_TX_BUFFER_SIZE ||
cfg->tx_buffer_size > ESP_SPP_MAX_TX_BUFFER_SIZE))) {
LOG_WARN("Invalid tx buffer size");
return ESP_ERR_INVALID_ARG;
}
@@ -82,13 +81,14 @@ esp_err_t esp_spp_deinit(void)
esp_err_t esp_spp_start_discovery(esp_bd_addr_t bd_addr)
{
sdp_uuid.len = 16;
memcpy(sdp_uuid.uu.uuid128, UUID_SPP, sizeof(sdp_uuid.uu.uuid128));
btc_msg_t msg;
btc_spp_args_t arg;
tSDP_UUID sdp_uuid;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
sdp_uuid.len = 16;
memcpy(sdp_uuid.uu.uuid128, UUID_SPP, sizeof(sdp_uuid.uu.uuid128));
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_SPP;
msg.act = BTC_SPP_ACT_START_DISCOVERY;
@@ -112,7 +112,7 @@ esp_err_t esp_spp_connect(esp_spp_sec_t sec_mask,
sec_mask != ESP_SPP_SEC_AUTHENTICATE &&
sec_mask != (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT)) {
LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHENTICATE"
"or (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only\n");
"or (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only");
}
msg.sig = BTC_SIG_API_CALL;
@@ -162,7 +162,7 @@ esp_err_t esp_spp_start_srv_with_cfg(const esp_spp_start_srv_cfg_t *cfg)
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (cfg == NULL || cfg->name == NULL || strlen(cfg->name) > ESP_SPP_SERVER_NAME_MAX) {
LOG_ERROR("Invalid server name!\n");
LOG_ERROR("Invalid server name!");
return ESP_ERR_INVALID_ARG;
}
@@ -175,7 +175,7 @@ esp_err_t esp_spp_start_srv_with_cfg(const esp_spp_start_srv_cfg_t *cfg)
LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHENTICATE,"
"(ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT),"
"ESP_SPP_SEC_IN_16_DIGITS, (ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE), or"
"(ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only\n");
"(ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only");
}
msg.sig = BTC_SIG_API_CALL;
@@ -213,7 +213,7 @@ esp_err_t esp_spp_stop_srv_scn(uint8_t scn)
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((scn == 0) || (scn >= PORT_MAX_RFC_PORTS)) {
LOG_ERROR("Invalid SCN!\n");
LOG_ERROR("Invalid SCN!");
return ESP_ERR_INVALID_ARG;
}
@@ -231,7 +231,7 @@ esp_err_t esp_spp_write(uint32_t handle, int len, uint8_t *p_data)
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (len <= 0 || p_data == NULL) {
LOG_ERROR("Invalid data or len!\n");
LOG_ERROR("Invalid data or len!");
return ESP_ERR_INVALID_ARG;
}

35
components/bt/host/bluedroid/bta/jv/bta_jv_act.c
View File

@@ -24,6 +24,7 @@
#include <pthread.h>
#include <stdlib.h>
#include <string.h>
#include "osi/allocator.h"
#include "osi/osi.h"
@@ -37,9 +38,7 @@
#include "stack/btm_api.h"
#include "btm_int.h"
#include "stack/sdp_api.h"
#include "stack/l2c_api.h"
#include "stack/port_api.h"
#include <string.h>
#include "stack/rfcdefs.h"
#include "stack/avct_api.h"
#include "stack/avdt_api.h"
@@ -301,7 +300,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
UINT8 used = 0, i, listen = 0;
tPORT_STATE port_state;
UINT32 event_mask = BTA_JV_RFC_EV_MASK;
UINT32 scn_num = (UINT32)p_cb->scn;
UINT32 scn_num = 0;
tBTA_JV evt_data = {0};
if (!p_cb || !p_pcb) {
@@ -423,6 +422,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
evt_data.rfc_srv_open.handle = 0;
evt_data.rfc_srv_open.new_listen_handle = p_pcb->handle;
evt_data.rfc_srv_open.status = BTA_JV_SUCCESS;
scn_num = (UINT32)p_cb->scn;
p_pcb->user_data = p_cb->p_cback(BTA_JV_RFCOMM_SRV_OPEN_EVT, &evt_data, (void *)scn_num);
}
}
@@ -509,9 +509,12 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
int i, j, bd_counter = 0, appid_counter = 0;
for (i = 0; i < BTA_JV_PM_MAX_NUM; i++) {
p_cb = NULL;
if ((bta_jv_cb.pm_cb[i].state != BTA_JV_PM_FREE_ST) &&
(jv_handle == bta_jv_cb.pm_cb[i].handle)) {
p_cb = NULL;
bd_counter = 0;
appid_counter = 0;
for (j = 0; j < BTA_JV_PM_MAX_NUM; j++) {
if (bdcmp(bta_jv_cb.pm_cb[j].peer_bd_addr, bta_jv_cb.pm_cb[i].peer_bd_addr) == 0) {
bd_counter++;
@@ -721,11 +724,12 @@ BOOLEAN bta_jv_check_psm(UINT16 psm)
void bta_jv_enable(tBTA_JV_MSG *p_data)
{
tBTA_UTL_COD cod;
tBTA_JV_STATUS status = BTA_JV_SUCCESS;
memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list));
bta_jv_cb.p_dm_cback = p_data->enable.p_cback;
bta_jv_cb.p_dm_cback(BTA_JV_ENABLE_EVT, (tBTA_JV *)&status, 0);
memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list));
/* Set the Class of Device */
cod.major = BTM_COD_MAJOR_UNCLASSIFIED;
@@ -1744,7 +1748,7 @@ static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle, void* dat
void *user_data = NULL;
APPL_TRACE_DEBUG( "bta_jv_port_mgmt_cl_cback:code:%d, port_handle%d", code, port_handle);
if (NULL == p_cb || NULL == p_cb->p_cback) {
if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) {
return;
}
@@ -2021,7 +2025,7 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat
int failed = TRUE;
// APPL_TRACE_DEBUG("bta_jv_port_mgmt_sr_cback, code:0x%x, port_handle:%d", code, (uint16_t)port_handle);
if (NULL == p_cb || NULL == p_cb->p_cback) {
if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) {
// APPL_TRACE_ERROR("bta_jv_port_mgmt_sr_cback, p_cb:%p, p_cb->p_cback%p",
// p_cb, p_cb ? p_cb->p_cback : NULL);
return;
@@ -2044,10 +2048,10 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat
/* accept the connection defaulted */
if (p_mgmt_cb_arg) {
p_mgmt_cb_arg->accept = TRUE;
evt_data.rfc_srv_open.peer_mtu = p_mgmt_cb_arg->peer_mtu;
}
evt_data.rfc_srv_open.handle = p_pcb->handle;
evt_data.rfc_srv_open.status = BTA_JV_SUCCESS;
evt_data.rfc_srv_open.peer_mtu = p_mgmt_cb_arg->peer_mtu;
bdcpy(evt_data.rfc_srv_open.rem_bda, rem_bda);
tBTA_JV_PCB *p_pcb_new_listen = bta_jv_add_rfc_port(p_cb, p_pcb);
if (p_pcb_new_listen) {
@@ -2131,7 +2135,7 @@ static void bta_jv_port_event_sr_cback(UINT32 code, UINT16 port_handle)
tBTA_JV_RFC_CB *p_cb = bta_jv_rfc_port_to_cb(port_handle);
tBTA_JV evt_data = {0};
if (NULL == p_cb || NULL == p_cb->p_cback) {
if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) {
return;
}
@@ -2544,7 +2548,7 @@ static void bta_jv_pm_conn_busy(tBTA_JV_PM_CB *p_cb)
/*******************************************************************************
**
** Function bta_jv_pm_conn_busy
** Function bta_jv_pm_conn_idle
**
** Description set pm connection busy state (input param safe)
**
@@ -2892,10 +2896,13 @@ static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf)
tc = fcchan_get(chan, FALSE);
if (tc) {
t = fcclient_find_by_addr(tc->clients, bd_addr); // try to find an open socked for that addr and channel
if (!t) {
//no socket -> drop it
return;
}
if (!t) {
//no socket -> drop it
if (p_buf) {
osi_free(p_buf);
}
return;
}
sock_cback = t->p_cback;

9
components/bt/host/bluedroid/bta/jv/bta_jv_api.c
View File

@@ -35,7 +35,6 @@
#include "stack/gap_api.h"
#include "common/bt_target.h"
#include "stack/sdp_api.h"
#if (defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE)
@@ -700,9 +699,7 @@ tBTA_JV_STATUS BTA_JvL2capStopServerLE(UINT16 local_chan, void *user_data)
**
** Function BTA_JvL2capRead
**
** Description This function reads data from an L2CAP connecti;
tBTA_JV_RFC_CB *p_cb = rc->p_cb;
on
** Description This function reads data from an L2CAP connection
** When the operation is complete, tBTA_JV_L2CAP_CBACK is
** called with BTA_JV_L2CAP_READ_EVT.
**
@@ -1140,7 +1137,9 @@ tBTA_JV_STATUS BTA_JvRfcommReady(UINT32 handle, UINT32 *p_data_size)
status = BTA_JV_SUCCESS;
}
}
*p_data_size = size;
if (p_data_size) {
*p_data_size = size;
}
return (status);
}

7
components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c
View File

@@ -19,8 +19,7 @@
/******************************************************************************
*
* This file contains compile-time configurable constants for advanced
* audio
* This file contains compile-time configurable constants for Java I/F
*
******************************************************************************/
@@ -49,7 +48,7 @@ static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE]
#endif
/* JV configuration structure */
/*const */tBTA_JV_CFG bta_jv_cfg = {
tBTA_JV_CFG bta_jv_cfg = {
BTA_JV_SDP_RAW_DATA_SIZE, /* The size of p_sdp_raw_data */
BTA_JV_SDP_DB_SIZE, /* The size of p_sdp_db_data */
#if BTA_DYNAMIC_MEMORY == FALSE
@@ -61,7 +60,7 @@ static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE]
#endif
};
tBTA_JV_CFG *p_bta_jv_cfg = (tBTA_JV_CFG *) &bta_jv_cfg;
tBTA_JV_CFG *p_bta_jv_cfg = &bta_jv_cfg;
#endif ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE

4
components/bt/host/bluedroid/bta/jv/bta_jv_main.c
View File

@@ -95,6 +95,10 @@ const tBTA_JV_ACTION bta_jv_action[] = {
*******************************************************************************/
BOOLEAN bta_jv_sm_execute(BT_HDR *p_msg)
{
if (!p_msg) {
return FALSE;
}
BOOLEAN ret = FALSE;
UINT16 action = (p_msg->event & 0x00ff);
/* execute action functions */

2
components/bt/host/bluedroid/stack/goep/goepc_api.c
View File

@@ -84,7 +84,7 @@ UINT16 GOEPC_Open(tOBEX_SVR_INFO *svr, tGOEPC_EVT_CBACK callback, UINT16 *out_ha
p_ccb = goepc_allocate_ccb();
if (p_ccb == NULL) {
ret = GOEP_NO_RESOURCES;
ret = GOEP_NO_RESOURCES;
break;
}

50
components/bt/host/bluedroid/stack/goep/goepc_main.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -183,7 +183,7 @@ void goepc_obex_callback(UINT16 handle, UINT8 event, tOBEX_MSG *msg)
case OBEX_DISCONNECT_EVT:
/* when we received this event, obex connection already disconnect */
p_ccb->obex_handle = 0;
goepc_sm_event = GOEPC_SM_EVENT_DISCONNECT;;
goepc_sm_event = GOEPC_SM_EVENT_DISCONNECT;
exec_sm = TRUE;
break;
case OBEX_CONGEST_EVT:
@@ -316,11 +316,16 @@ static void goepc_sm_state_opening(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *
GOEPC_TRACE_ERROR("goepc_sm_state_opening received unexpected response from peer\n");
if (p_data->pkt != NULL) {
osi_free(p_data->pkt);
p_data->pkt = NULL;
}
goepc_sm_act_disconnect(p_ccb);
break;
default:
GOEPC_TRACE_ERROR("goepc_sm_state_opening unexpected event: 0x%x\n", event);
if (p_data->pkt != NULL) {
osi_free(p_data->pkt);
p_data->pkt = NULL;
}
break;
}
}
@@ -349,6 +354,10 @@ static void goepc_sm_state_opened_idle(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DA
break;
default:
GOEPC_TRACE_ERROR("goepc_sm_state_opened_idle unexpected event: 0x%x\n", event);
if (p_data->pkt != NULL) {
osi_free(p_data->pkt);
p_data->pkt = NULL;
}
break;
}
}
@@ -374,6 +383,10 @@ static void goepc_sm_state_opened_req(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DAT
break;
default:
GOEPC_TRACE_ERROR("goepc_sm_state_opened_req unexpected event: 0x%x\n", event);
if (p_data->pkt != NULL) {
osi_free(p_data->pkt);
p_data->pkt = NULL;
}
break;
}
}
@@ -396,6 +409,10 @@ static void goepc_sm_state_opened_rsp(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DAT
break;
default:
GOEPC_TRACE_ERROR("goepc_sm_state_opened_rsp unexpected event: 0x%x\n", event);
if (p_data->pkt != NULL) {
osi_free(p_data->pkt);
p_data->pkt = NULL;
}
break;
}
}
@@ -431,10 +448,14 @@ BOOLEAN goepc_check_obex_req_allow(UINT8 state, BOOLEAN final)
void goepc_sm_execute(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *p_data)
{
bool free_pkt = false;
bool has_pkt = false;
switch (p_ccb->state)
{
case GOEPC_STATE_INIT:
/* do nothing */
free_pkt = true;
break;
case GOEPC_STATE_OPENING:
goepc_sm_state_opening(p_ccb, event, p_data);
@@ -449,9 +470,34 @@ void goepc_sm_execute(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *p_data)
goepc_sm_state_opened_rsp(p_ccb, event, p_data);
break;
default:
free_pkt = true;
GOEPC_TRACE_ERROR("goepc_sm_execute unexpected state: 0x%x\n", p_ccb->state);
break;
}
switch (event)
{
case GOEPC_SM_EVENT_REQ:
/* falls through */
case GOEPC_SM_EVENT_REQ_FB:
/* falls through */
case GOEPC_SM_EVENT_RSP:
/* falls through */
case GOEPC_SM_EVENT_RSP_FB:
/* falls through */
has_pkt = true;
break;
default:
has_pkt = false;
break;
}
if (has_pkt && free_pkt) {
if (p_data->pkt) {
osi_free(p_data->pkt);
p_data->pkt = NULL;
}
}
}
static void goepc_srm_sm_act_req(tGOEPC_CCB *p_ccb, BOOLEAN srm_en, BOOLEAN srm_wait)

14
components/bt/host/bluedroid/stack/obex/obex_api.c
View File

@@ -38,7 +38,7 @@ static inline void obex_server_to_tl_server(tOBEX_SVR_INFO *server, tOBEX_TL_SVR
}
}
static inline void obex_updata_packet_length(BT_HDR *p_buf, UINT16 len)
static inline void obex_update_packet_length(BT_HDR *p_buf, UINT16 len)
{
UINT8 *p_pkt_len = (UINT8 *)(p_buf + 1) + p_buf->offset + 1;
UINT16_TO_BE_FIELD(p_pkt_len, len);
@@ -66,12 +66,12 @@ UINT16 OBEX_Init(void)
#endif /* #if (OBEX_DYNAMIC_MEMORY) */
memset(&obex_cb, 0, sizeof(tOBEX_CB));
obex_cb.tl_ops[OBEX_OVER_L2CAP] = obex_tl_l2cap_ops_get();
if (obex_cb.tl_ops[OBEX_OVER_L2CAP]->init != NULL) {
if (obex_cb.tl_ops[OBEX_OVER_L2CAP] && obex_cb.tl_ops[OBEX_OVER_L2CAP]->init) {
obex_cb.tl_ops[OBEX_OVER_L2CAP]->init(obex_tl_l2cap_callback);
}
#if (RFCOMM_INCLUDED == TRUE)
obex_cb.tl_ops[OBEX_OVER_RFCOMM] = obex_tl_rfcomm_ops_get();
if (obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init != NULL) {
if (obex_cb.tl_ops[OBEX_OVER_RFCOMM] && obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init) {
obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init(obex_tl_rfcomm_callback);
}
#endif
@@ -89,11 +89,11 @@ UINT16 OBEX_Init(void)
*******************************************************************************/
void OBEX_Deinit(void)
{
if (obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit != NULL) {
if (obex_cb.tl_ops[OBEX_OVER_L2CAP] && obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit) {
obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit();
}
#if (RFCOMM_INCLUDED == TRUE)
if (obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit != NULL) {
if (obex_cb.tl_ops[OBEX_OVER_RFCOMM] && obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit) {
obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit();
}
#endif
@@ -327,7 +327,7 @@ UINT16 OBEX_BuildRequest(tOBEX_PARSE_INFO *info, UINT16 buff_size, BT_HDR **out_
}
buff_size += sizeof(BT_HDR) + OBEX_BT_HDR_MIN_OFFSET + OBEX_BT_HDR_RESERVE_LEN;
BT_HDR *p_buf= (BT_HDR *)osi_malloc(buff_size);
BT_HDR *p_buf = (BT_HDR *)osi_malloc(buff_size);
if (p_buf == NULL) {
return OBEX_NO_RESOURCES;
}
@@ -780,10 +780,10 @@ UINT8 *OBEX_GetNextHeader(BT_HDR *pkt, tOBEX_PARSE_INFO *info)
if (pkt == NULL || info == NULL) {
return NULL;
}
UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset;
if (info->next_header_pos == 0 || info->next_header_pos >= pkt->len) {
return NULL;
}
UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset;
UINT8 *header = p_data + info->next_header_pos;
UINT16 header_len = OBEX_GetHeaderLength(header);
info->next_header_pos += header_len;

8
components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -554,7 +554,7 @@ void obex_tl_l2cap_congestion_status_ind(UINT16 lcid, BOOLEAN is_congested)
** other APIs
**
*******************************************************************************/
void obex_tl_l2cap_init(tOBEX_TL_CBACK callback)
void obex_tl_l2cap_init(tOBEX_TL_CBACK *callback)
{
assert(callback != NULL);
#if (OBEX_DYNAMIC_MEMORY)
@@ -587,7 +587,7 @@ void obex_tl_l2cap_init(tOBEX_TL_CBACK callback)
/*******************************************************************************
**
** Function obex_tl_l2cap_init
** Function obex_tl_l2cap_deinit
**
** Description Deinitialize OBEX over L2CAP transport layer
**
@@ -674,7 +674,7 @@ void obex_tl_l2cap_disconnect(UINT16 hdl)
**
** Function obex_tl_l2cap_send_data
**
** Description Start the process of establishing a L2CAP connection
** Description Send data on an established L2CAP connection
**
** Returns OBEX_TL_SUCCESS, if data accepted
** OBEX_TL_CONGESTED, if data accepted and the channel is congested

2
components/bt/host/bluedroid/stack/obex/obex_tl_rfcomm.c
View File

@@ -357,6 +357,8 @@ UINT16 obex_tl_rfcomm_send(UINT16 handle, BT_HDR *p_buf)
if (PORT_Write(p_ccb->rfc_handle, p_buf) == PORT_SUCCESS) {
ret = OBEX_TL_SUCCESS;
} else {
osi_free(p_buf);
}
} while (0);
return ret;

8
components/bt/host/bluedroid/stack/rfcomm/port_api.c
View File

@@ -114,7 +114,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server,
RFCOMM_TRACE_API ("RFCOMM_CreateConnection() BDA: %02x-%02x-%02x-%02x-%02x-%02x",
bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4], bd_addr[5]);
*p_handle = 0;
if (p_handle) {
*p_handle = 0;
}
if (( scn == 0 ) || (scn >= PORT_MAX_RFC_PORTS )) {
/* Server Channel Number(SCN) should be in range 1...30 */
@@ -170,7 +172,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server,
RFCOMM_TRACE_EVENT ("RFCOMM_CreateConnection dlci:%d signal state:0x%x", dlci, p_port->default_signal_state);
*p_handle = p_port->inx;
if (p_handle) {
*p_handle = p_port->inx;
}
p_port->state = PORT_STATE_OPENING;
p_port->uuid = uuid;

2
components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c
View File

@@ -421,7 +421,7 @@ tRFC_MCB *rfc_find_lcid_mcb (UINT16 lcid)
**
** Function rfc_save_lcid_mcb
**
** Description This function returns MCB block supporting local cid
** Description This function saves MCB block supporting local cid
**
*******************************************************************************/
void rfc_save_lcid_mcb (tRFC_MCB *p_mcb, UINT16 lcid)

5
components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c
View File

@@ -119,6 +119,9 @@ void rfc_mx_sm_execute (tRFC_MCB *p_mcb, UINT16 event, void *p_data)
rfc_mx_sm_state_disc_wait_ua (p_mcb, event, p_data);
break;
default:
RFCOMM_TRACE_DEBUG("invalid state:%d\n", p_mcb->state);
break;
}
}
@@ -215,7 +218,7 @@ void rfc_mx_sm_state_wait_conn_cnf (tRFC_MCB *p_mcb, UINT16 event, void *p_data)
return;
/* There is some new timing so that Config Ind comes before security is completed
so we are still waiting fo the confirmation. */
so we are still waiting for the confirmation. */
case RFC_MX_EVENT_CONF_IND:
rfc_mx_conf_ind (p_mcb, (tL2CAP_CFG_INFO *)p_data);
return;

3
components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c
View File

@@ -597,8 +597,7 @@ void rfc_process_rpn (tRFC_MCB *p_mcb, BOOLEAN is_command,
}
/* If we are not awaiting response just ignore it */
p_port = port_find_mcb_dlci_port (p_mcb, p_frame->dlci);
if ((p_port == NULL) || !(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) {
if (!(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) {
return;
}

2
components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c
View File

@@ -359,7 +359,7 @@ void RFCOMM_LineStatusReq (tRFC_MCB *p_mcb, UINT8 dlci, UINT8 status)
*******************************************************************************/
void RFCOMM_DlcReleaseReq (tRFC_MCB *p_mcb, UINT8 dlci)
{
rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, 0);
rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, NULL);
}

21
components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c
View File

@@ -527,16 +527,12 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr)
UINT8 dlci;
BOOLEAN get_dlci = FALSE;
tPORT *p_port;
tPORT_CTRL *p_pars;
tPORT_CTRL pars;
tRFC_MCB *p_mcb;
if ((p_pars = (tPORT_CTRL *)osi_malloc(sizeof(tPORT_CTRL))) == NULL) {
return;
}
p_pars->modem_signal = 0;
p_pars->break_signal = 0;
p_pars->fc = TRUE;
pars.modem_signal = 0;
pars.break_signal = 0;
pars.fc = TRUE;
p_mcb = port_find_mcb (cert_pts_addr);
@@ -549,12 +545,11 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr)
}
}
if (get_dlci) {
rfc_send_msc(p_mcb, dlci, TRUE, p_pars);
if (get_dlci && p_mcb) {
rfc_send_msc(p_mcb, dlci, TRUE, &pars);
} else {
RFCOMM_TRACE_ERROR ("Get dlci fail");
}
osi_free(p_pars);
}
#endif /* BT_RFCOMM_BQB_INCLUDED */
@@ -794,7 +789,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf)
RFCOMM_TRACE_ERROR("Illegal MX Frame len:%d < 2", length);
osi_free(p_buf);
return;
}
}
p_rx_frame->ea = *p_data & RFCOMM_EA;
p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;
@@ -991,7 +986,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf)
if (!ea || !cr || !p_rx_frame->dlci
|| !RFCOMM_VALID_DLCI (p_rx_frame->dlci)) {
RFCOMM_TRACE_ERROR ("Bad RPN frame");
RFCOMM_TRACE_ERROR ("Bad RLS frame");
break;
}

14
components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c
View File

@@ -121,6 +121,10 @@ BOOLEAN rfc_check_fcs (UINT16 len, UINT8 *p, UINT8 received_fcs)
return (fcs == 0xCF);
}
void osi_free_fun(void *p)
{
osi_free(p);
}
/*******************************************************************************
**
@@ -168,7 +172,7 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator)
p_mcb = &rfc_cb.port.rfc_mcb[j];
if (rfc_cb.port.rfc_mcb[j].state == RFC_MX_STATE_IDLE) {
/* New multiplexer control block */
fixed_queue_free(p_mcb->cmd_q, NULL);
fixed_queue_free(p_mcb->cmd_q, osi_free_fun);
rfc_timer_free(p_mcb);
memset (p_mcb, 0, sizeof (tRFC_MCB));
memcpy (p_mcb->bd_addr, bd_addr, BD_ADDR_LEN);
@@ -188,15 +192,11 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator)
return (NULL);
}
void osi_free_fun(void *p)
{
osi_free(p);
}
/*******************************************************************************
**
** Function rfc_release_multiplexer_channel
**
** Description This function returns existing or new control block for
** Description This function releases existing control block for
** the BD_ADDR.
**
*******************************************************************************/
@@ -299,7 +299,7 @@ void rfc_port_timer_stop (tPORT *p_port)
*******************************************************************************/
void rfc_port_timer_free (tPORT *p_port)
{
RFCOMM_TRACE_EVENT ("rfc_port_timer_stop");
RFCOMM_TRACE_EVENT ("rfc_port_timer_free");
btu_free_timer (&p_port->rfc.tle);
memset(&p_port->rfc.tle, 0, sizeof(TIMER_LIST_ENT));