From 51cf9d7b465a1cbb7a053475ffa43dea5c1926c0 Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Tue, 24 Mar 2026 20:27:23 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed the vulerabilities from AI code review in SPP --- .../bt/host/bluedroid/api/esp_spp_api.c | 22 ++++---- .../bt/host/bluedroid/bta/jv/bta_jv_act.c | 35 +++++++------ .../bt/host/bluedroid/bta/jv/bta_jv_api.c | 9 ++-- .../bt/host/bluedroid/bta/jv/bta_jv_cfg.c | 7 ++- .../bt/host/bluedroid/bta/jv/bta_jv_main.c | 4 ++ .../bt/host/bluedroid/stack/goep/goepc_api.c | 2 +- .../bt/host/bluedroid/stack/goep/goepc_main.c | 50 ++++++++++++++++++- .../bt/host/bluedroid/stack/obex/obex_api.c | 14 +++--- .../host/bluedroid/stack/obex/obex_tl_l2cap.c | 8 +-- .../bluedroid/stack/obex/obex_tl_rfcomm.c | 2 + .../bt/host/bluedroid/stack/rfcomm/port_api.c | 8 ++- .../bluedroid/stack/rfcomm/rfc_l2cap_if.c | 2 +- .../host/bluedroid/stack/rfcomm/rfc_mx_fsm.c | 5 +- .../bluedroid/stack/rfcomm/rfc_port_fsm.c | 3 +- .../host/bluedroid/stack/rfcomm/rfc_port_if.c | 2 +- .../bluedroid/stack/rfcomm/rfc_ts_frames.c | 21 +++----- .../host/bluedroid/stack/rfcomm/rfc_utils.c | 14 +++--- 17 files changed, 133 insertions(+), 75 deletions(-) diff --git a/components/bt/host/bluedroid/api/esp_spp_api.c b/components/bt/host/bluedroid/api/esp_spp_api.c index c739bb0cd2b..16847efe341 100644 --- a/components/bt/host/bluedroid/api/esp_spp_api.c +++ b/components/bt/host/bluedroid/api/esp_spp_api.c @@ -18,7 +18,6 @@ static const uint8_t UUID_SPP[16] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00, 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB }; -static tSDP_UUID sdp_uuid; esp_err_t esp_spp_register_callback(esp_spp_cb_t callback) { @@ -50,8 +49,8 @@ esp_err_t esp_spp_enhanced_init(const esp_spp_cfg_t *cfg) btc_spp_args_t arg; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if (cfg->mode == ESP_SPP_MODE_VFS && (cfg->tx_buffer_size < ESP_SPP_MIN_TX_BUFFER_SIZE || - cfg->tx_buffer_size > ESP_SPP_MAX_TX_BUFFER_SIZE)) { + if (!cfg || (cfg->mode == ESP_SPP_MODE_VFS && (cfg->tx_buffer_size < ESP_SPP_MIN_TX_BUFFER_SIZE || + cfg->tx_buffer_size > ESP_SPP_MAX_TX_BUFFER_SIZE))) { LOG_WARN("Invalid tx buffer size"); return ESP_ERR_INVALID_ARG; } @@ -82,13 +81,14 @@ esp_err_t esp_spp_deinit(void) esp_err_t esp_spp_start_discovery(esp_bd_addr_t bd_addr) { - sdp_uuid.len = 16; - memcpy(sdp_uuid.uu.uuid128, UUID_SPP, sizeof(sdp_uuid.uu.uuid128)); - btc_msg_t msg; btc_spp_args_t arg; + tSDP_UUID sdp_uuid; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + sdp_uuid.len = 16; + memcpy(sdp_uuid.uu.uuid128, UUID_SPP, sizeof(sdp_uuid.uu.uuid128)); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_SPP; msg.act = BTC_SPP_ACT_START_DISCOVERY; @@ -112,7 +112,7 @@ esp_err_t esp_spp_connect(esp_spp_sec_t sec_mask, sec_mask != ESP_SPP_SEC_AUTHENTICATE && sec_mask != (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT)) { LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHENTICATE" - "or (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only\n"); + "or (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only"); } msg.sig = BTC_SIG_API_CALL; @@ -162,7 +162,7 @@ esp_err_t esp_spp_start_srv_with_cfg(const esp_spp_start_srv_cfg_t *cfg) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (cfg == NULL || cfg->name == NULL || strlen(cfg->name) > ESP_SPP_SERVER_NAME_MAX) { - LOG_ERROR("Invalid server name!\n"); + LOG_ERROR("Invalid server name!"); return ESP_ERR_INVALID_ARG; } @@ -175,7 +175,7 @@ esp_err_t esp_spp_start_srv_with_cfg(const esp_spp_start_srv_cfg_t *cfg) LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHENTICATE," "(ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT)," "ESP_SPP_SEC_IN_16_DIGITS, (ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE), or" - "(ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only\n"); + "(ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only"); } msg.sig = BTC_SIG_API_CALL; @@ -213,7 +213,7 @@ esp_err_t esp_spp_stop_srv_scn(uint8_t scn) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if ((scn == 0) || (scn >= PORT_MAX_RFC_PORTS)) { - LOG_ERROR("Invalid SCN!\n"); + LOG_ERROR("Invalid SCN!"); return ESP_ERR_INVALID_ARG; } @@ -231,7 +231,7 @@ esp_err_t esp_spp_write(uint32_t handle, int len, uint8_t *p_data) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (len <= 0 || p_data == NULL) { - LOG_ERROR("Invalid data or len!\n"); + LOG_ERROR("Invalid data or len!"); return ESP_ERR_INVALID_ARG; } diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_act.c b/components/bt/host/bluedroid/bta/jv/bta_jv_act.c index 991803df0ac..78fc08b04d1 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_act.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_act.c @@ -24,6 +24,7 @@ #include #include +#include #include "osi/allocator.h" #include "osi/osi.h" @@ -37,9 +38,7 @@ #include "stack/btm_api.h" #include "btm_int.h" #include "stack/sdp_api.h" -#include "stack/l2c_api.h" #include "stack/port_api.h" -#include #include "stack/rfcdefs.h" #include "stack/avct_api.h" #include "stack/avdt_api.h" @@ -301,7 +300,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc UINT8 used = 0, i, listen = 0; tPORT_STATE port_state; UINT32 event_mask = BTA_JV_RFC_EV_MASK; - UINT32 scn_num = (UINT32)p_cb->scn; + UINT32 scn_num = 0; tBTA_JV evt_data = {0}; if (!p_cb || !p_pcb) { @@ -423,6 +422,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc evt_data.rfc_srv_open.handle = 0; evt_data.rfc_srv_open.new_listen_handle = p_pcb->handle; evt_data.rfc_srv_open.status = BTA_JV_SUCCESS; + scn_num = (UINT32)p_cb->scn; p_pcb->user_data = p_cb->p_cback(BTA_JV_RFCOMM_SRV_OPEN_EVT, &evt_data, (void *)scn_num); } } @@ -509,9 +509,12 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle) int i, j, bd_counter = 0, appid_counter = 0; for (i = 0; i < BTA_JV_PM_MAX_NUM; i++) { - p_cb = NULL; if ((bta_jv_cb.pm_cb[i].state != BTA_JV_PM_FREE_ST) && (jv_handle == bta_jv_cb.pm_cb[i].handle)) { + p_cb = NULL; + bd_counter = 0; + appid_counter = 0; + for (j = 0; j < BTA_JV_PM_MAX_NUM; j++) { if (bdcmp(bta_jv_cb.pm_cb[j].peer_bd_addr, bta_jv_cb.pm_cb[i].peer_bd_addr) == 0) { bd_counter++; @@ -721,11 +724,12 @@ BOOLEAN bta_jv_check_psm(UINT16 psm) void bta_jv_enable(tBTA_JV_MSG *p_data) { tBTA_UTL_COD cod; - tBTA_JV_STATUS status = BTA_JV_SUCCESS; + + memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list)); + bta_jv_cb.p_dm_cback = p_data->enable.p_cback; bta_jv_cb.p_dm_cback(BTA_JV_ENABLE_EVT, (tBTA_JV *)&status, 0); - memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list)); /* Set the Class of Device */ cod.major = BTM_COD_MAJOR_UNCLASSIFIED; @@ -1744,7 +1748,7 @@ static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle, void* dat void *user_data = NULL; APPL_TRACE_DEBUG( "bta_jv_port_mgmt_cl_cback:code:%d, port_handle%d", code, port_handle); - if (NULL == p_cb || NULL == p_cb->p_cback) { + if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) { return; } @@ -2021,7 +2025,7 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat int failed = TRUE; // APPL_TRACE_DEBUG("bta_jv_port_mgmt_sr_cback, code:0x%x, port_handle:%d", code, (uint16_t)port_handle); - if (NULL == p_cb || NULL == p_cb->p_cback) { + if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) { // APPL_TRACE_ERROR("bta_jv_port_mgmt_sr_cback, p_cb:%p, p_cb->p_cback%p", // p_cb, p_cb ? p_cb->p_cback : NULL); return; @@ -2044,10 +2048,10 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat /* accept the connection defaulted */ if (p_mgmt_cb_arg) { p_mgmt_cb_arg->accept = TRUE; + evt_data.rfc_srv_open.peer_mtu = p_mgmt_cb_arg->peer_mtu; } evt_data.rfc_srv_open.handle = p_pcb->handle; evt_data.rfc_srv_open.status = BTA_JV_SUCCESS; - evt_data.rfc_srv_open.peer_mtu = p_mgmt_cb_arg->peer_mtu; bdcpy(evt_data.rfc_srv_open.rem_bda, rem_bda); tBTA_JV_PCB *p_pcb_new_listen = bta_jv_add_rfc_port(p_cb, p_pcb); if (p_pcb_new_listen) { @@ -2131,7 +2135,7 @@ static void bta_jv_port_event_sr_cback(UINT32 code, UINT16 port_handle) tBTA_JV_RFC_CB *p_cb = bta_jv_rfc_port_to_cb(port_handle); tBTA_JV evt_data = {0}; - if (NULL == p_cb || NULL == p_cb->p_cback) { + if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) { return; } @@ -2544,7 +2548,7 @@ static void bta_jv_pm_conn_busy(tBTA_JV_PM_CB *p_cb) /******************************************************************************* ** - ** Function bta_jv_pm_conn_busy + ** Function bta_jv_pm_conn_idle ** ** Description set pm connection busy state (input param safe) ** @@ -2892,10 +2896,13 @@ static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf) tc = fcchan_get(chan, FALSE); if (tc) { t = fcclient_find_by_addr(tc->clients, bd_addr); // try to find an open socked for that addr and channel - if (!t) { - //no socket -> drop it - return; + } + if (!t) { + //no socket -> drop it + if (p_buf) { + osi_free(p_buf); } + return; } sock_cback = t->p_cback; diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_api.c b/components/bt/host/bluedroid/bta/jv/bta_jv_api.c index c83f9b4e8f6..4909859772f 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_api.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_api.c @@ -35,7 +35,6 @@ #include "stack/gap_api.h" #include "common/bt_target.h" -#include "stack/sdp_api.h" #if (defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE) @@ -700,9 +699,7 @@ tBTA_JV_STATUS BTA_JvL2capStopServerLE(UINT16 local_chan, void *user_data) ** ** Function BTA_JvL2capRead ** -** Description This function reads data from an L2CAP connecti; - tBTA_JV_RFC_CB *p_cb = rc->p_cb; -on +** Description This function reads data from an L2CAP connection ** When the operation is complete, tBTA_JV_L2CAP_CBACK is ** called with BTA_JV_L2CAP_READ_EVT. ** @@ -1140,7 +1137,9 @@ tBTA_JV_STATUS BTA_JvRfcommReady(UINT32 handle, UINT32 *p_data_size) status = BTA_JV_SUCCESS; } } - *p_data_size = size; + if (p_data_size) { + *p_data_size = size; + } return (status); } diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c b/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c index 9ec4d77df06..257eccb31bd 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c @@ -19,8 +19,7 @@ /****************************************************************************** * - * This file contains compile-time configurable constants for advanced - * audio + * This file contains compile-time configurable constants for Java I/F * ******************************************************************************/ @@ -49,7 +48,7 @@ static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE] #endif /* JV configuration structure */ -/*const */tBTA_JV_CFG bta_jv_cfg = { +tBTA_JV_CFG bta_jv_cfg = { BTA_JV_SDP_RAW_DATA_SIZE, /* The size of p_sdp_raw_data */ BTA_JV_SDP_DB_SIZE, /* The size of p_sdp_db_data */ #if BTA_DYNAMIC_MEMORY == FALSE @@ -61,7 +60,7 @@ static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE] #endif }; -tBTA_JV_CFG *p_bta_jv_cfg = (tBTA_JV_CFG *) &bta_jv_cfg; +tBTA_JV_CFG *p_bta_jv_cfg = &bta_jv_cfg; #endif ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_main.c b/components/bt/host/bluedroid/bta/jv/bta_jv_main.c index f233e933505..69324a8625a 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_main.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_main.c @@ -95,6 +95,10 @@ const tBTA_JV_ACTION bta_jv_action[] = { *******************************************************************************/ BOOLEAN bta_jv_sm_execute(BT_HDR *p_msg) { + if (!p_msg) { + return FALSE; + } + BOOLEAN ret = FALSE; UINT16 action = (p_msg->event & 0x00ff); /* execute action functions */ diff --git a/components/bt/host/bluedroid/stack/goep/goepc_api.c b/components/bt/host/bluedroid/stack/goep/goepc_api.c index 06be8f59cbe..c34112314f6 100644 --- a/components/bt/host/bluedroid/stack/goep/goepc_api.c +++ b/components/bt/host/bluedroid/stack/goep/goepc_api.c @@ -84,7 +84,7 @@ UINT16 GOEPC_Open(tOBEX_SVR_INFO *svr, tGOEPC_EVT_CBACK callback, UINT16 *out_ha p_ccb = goepc_allocate_ccb(); if (p_ccb == NULL) { - ret = GOEP_NO_RESOURCES; + ret = GOEP_NO_RESOURCES; break; } diff --git a/components/bt/host/bluedroid/stack/goep/goepc_main.c b/components/bt/host/bluedroid/stack/goep/goepc_main.c index 75b83919f37..7c3cb778d03 100644 --- a/components/bt/host/bluedroid/stack/goep/goepc_main.c +++ b/components/bt/host/bluedroid/stack/goep/goepc_main.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -183,7 +183,7 @@ void goepc_obex_callback(UINT16 handle, UINT8 event, tOBEX_MSG *msg) case OBEX_DISCONNECT_EVT: /* when we received this event, obex connection already disconnect */ p_ccb->obex_handle = 0; - goepc_sm_event = GOEPC_SM_EVENT_DISCONNECT;; + goepc_sm_event = GOEPC_SM_EVENT_DISCONNECT; exec_sm = TRUE; break; case OBEX_CONGEST_EVT: @@ -316,11 +316,16 @@ static void goepc_sm_state_opening(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA * GOEPC_TRACE_ERROR("goepc_sm_state_opening received unexpected response from peer\n"); if (p_data->pkt != NULL) { osi_free(p_data->pkt); + p_data->pkt = NULL; } goepc_sm_act_disconnect(p_ccb); break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opening unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -349,6 +354,10 @@ static void goepc_sm_state_opened_idle(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DA break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opened_idle unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -374,6 +383,10 @@ static void goepc_sm_state_opened_req(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DAT break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opened_req unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -396,6 +409,10 @@ static void goepc_sm_state_opened_rsp(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DAT break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opened_rsp unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -431,10 +448,14 @@ BOOLEAN goepc_check_obex_req_allow(UINT8 state, BOOLEAN final) void goepc_sm_execute(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *p_data) { + bool free_pkt = false; + bool has_pkt = false; + switch (p_ccb->state) { case GOEPC_STATE_INIT: /* do nothing */ + free_pkt = true; break; case GOEPC_STATE_OPENING: goepc_sm_state_opening(p_ccb, event, p_data); @@ -449,9 +470,34 @@ void goepc_sm_execute(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *p_data) goepc_sm_state_opened_rsp(p_ccb, event, p_data); break; default: + free_pkt = true; GOEPC_TRACE_ERROR("goepc_sm_execute unexpected state: 0x%x\n", p_ccb->state); break; } + + switch (event) + { + case GOEPC_SM_EVENT_REQ: + /* falls through */ + case GOEPC_SM_EVENT_REQ_FB: + /* falls through */ + case GOEPC_SM_EVENT_RSP: + /* falls through */ + case GOEPC_SM_EVENT_RSP_FB: + /* falls through */ + has_pkt = true; + break; + default: + has_pkt = false; + break; + } + + if (has_pkt && free_pkt) { + if (p_data->pkt) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } + } } static void goepc_srm_sm_act_req(tGOEPC_CCB *p_ccb, BOOLEAN srm_en, BOOLEAN srm_wait) diff --git a/components/bt/host/bluedroid/stack/obex/obex_api.c b/components/bt/host/bluedroid/stack/obex/obex_api.c index dedaa8c8b6f..bfbe61c6290 100644 --- a/components/bt/host/bluedroid/stack/obex/obex_api.c +++ b/components/bt/host/bluedroid/stack/obex/obex_api.c @@ -38,7 +38,7 @@ static inline void obex_server_to_tl_server(tOBEX_SVR_INFO *server, tOBEX_TL_SVR } } -static inline void obex_updata_packet_length(BT_HDR *p_buf, UINT16 len) +static inline void obex_update_packet_length(BT_HDR *p_buf, UINT16 len) { UINT8 *p_pkt_len = (UINT8 *)(p_buf + 1) + p_buf->offset + 1; UINT16_TO_BE_FIELD(p_pkt_len, len); @@ -66,12 +66,12 @@ UINT16 OBEX_Init(void) #endif /* #if (OBEX_DYNAMIC_MEMORY) */ memset(&obex_cb, 0, sizeof(tOBEX_CB)); obex_cb.tl_ops[OBEX_OVER_L2CAP] = obex_tl_l2cap_ops_get(); - if (obex_cb.tl_ops[OBEX_OVER_L2CAP]->init != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_L2CAP] && obex_cb.tl_ops[OBEX_OVER_L2CAP]->init) { obex_cb.tl_ops[OBEX_OVER_L2CAP]->init(obex_tl_l2cap_callback); } #if (RFCOMM_INCLUDED == TRUE) obex_cb.tl_ops[OBEX_OVER_RFCOMM] = obex_tl_rfcomm_ops_get(); - if (obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_RFCOMM] && obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init) { obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init(obex_tl_rfcomm_callback); } #endif @@ -89,11 +89,11 @@ UINT16 OBEX_Init(void) *******************************************************************************/ void OBEX_Deinit(void) { - if (obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_L2CAP] && obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit) { obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit(); } #if (RFCOMM_INCLUDED == TRUE) - if (obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_RFCOMM] && obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit) { obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit(); } #endif @@ -327,7 +327,7 @@ UINT16 OBEX_BuildRequest(tOBEX_PARSE_INFO *info, UINT16 buff_size, BT_HDR **out_ } buff_size += sizeof(BT_HDR) + OBEX_BT_HDR_MIN_OFFSET + OBEX_BT_HDR_RESERVE_LEN; - BT_HDR *p_buf= (BT_HDR *)osi_malloc(buff_size); + BT_HDR *p_buf = (BT_HDR *)osi_malloc(buff_size); if (p_buf == NULL) { return OBEX_NO_RESOURCES; } @@ -780,10 +780,10 @@ UINT8 *OBEX_GetNextHeader(BT_HDR *pkt, tOBEX_PARSE_INFO *info) if (pkt == NULL || info == NULL) { return NULL; } - UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset; if (info->next_header_pos == 0 || info->next_header_pos >= pkt->len) { return NULL; } + UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset; UINT8 *header = p_data + info->next_header_pos; UINT16 header_len = OBEX_GetHeaderLength(header); info->next_header_pos += header_len; diff --git a/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c b/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c index d509b4cfabf..888866c0286 100644 --- a/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c +++ b/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -554,7 +554,7 @@ void obex_tl_l2cap_congestion_status_ind(UINT16 lcid, BOOLEAN is_congested) ** other APIs ** *******************************************************************************/ -void obex_tl_l2cap_init(tOBEX_TL_CBACK callback) +void obex_tl_l2cap_init(tOBEX_TL_CBACK *callback) { assert(callback != NULL); #if (OBEX_DYNAMIC_MEMORY) @@ -587,7 +587,7 @@ void obex_tl_l2cap_init(tOBEX_TL_CBACK callback) /******************************************************************************* ** -** Function obex_tl_l2cap_init +** Function obex_tl_l2cap_deinit ** ** Description Deinitialize OBEX over L2CAP transport layer ** @@ -674,7 +674,7 @@ void obex_tl_l2cap_disconnect(UINT16 hdl) ** ** Function obex_tl_l2cap_send_data ** -** Description Start the process of establishing a L2CAP connection +** Description Send data on an established L2CAP connection ** ** Returns OBEX_TL_SUCCESS, if data accepted ** OBEX_TL_CONGESTED, if data accepted and the channel is congested diff --git a/components/bt/host/bluedroid/stack/obex/obex_tl_rfcomm.c b/components/bt/host/bluedroid/stack/obex/obex_tl_rfcomm.c index ce7799c8673..0eb3457e419 100644 --- a/components/bt/host/bluedroid/stack/obex/obex_tl_rfcomm.c +++ b/components/bt/host/bluedroid/stack/obex/obex_tl_rfcomm.c @@ -357,6 +357,8 @@ UINT16 obex_tl_rfcomm_send(UINT16 handle, BT_HDR *p_buf) if (PORT_Write(p_ccb->rfc_handle, p_buf) == PORT_SUCCESS) { ret = OBEX_TL_SUCCESS; + } else { + osi_free(p_buf); } } while (0); return ret; diff --git a/components/bt/host/bluedroid/stack/rfcomm/port_api.c b/components/bt/host/bluedroid/stack/rfcomm/port_api.c index a6b5920cdbc..b09e89d158f 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/port_api.c +++ b/components/bt/host/bluedroid/stack/rfcomm/port_api.c @@ -114,7 +114,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server, RFCOMM_TRACE_API ("RFCOMM_CreateConnection() BDA: %02x-%02x-%02x-%02x-%02x-%02x", bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4], bd_addr[5]); - *p_handle = 0; + if (p_handle) { + *p_handle = 0; + } if (( scn == 0 ) || (scn >= PORT_MAX_RFC_PORTS )) { /* Server Channel Number(SCN) should be in range 1...30 */ @@ -170,7 +172,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server, RFCOMM_TRACE_EVENT ("RFCOMM_CreateConnection dlci:%d signal state:0x%x", dlci, p_port->default_signal_state); - *p_handle = p_port->inx; + if (p_handle) { + *p_handle = p_port->inx; + } p_port->state = PORT_STATE_OPENING; p_port->uuid = uuid; diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c index aa28da9d1b9..2f866968041 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c @@ -421,7 +421,7 @@ tRFC_MCB *rfc_find_lcid_mcb (UINT16 lcid) ** ** Function rfc_save_lcid_mcb ** -** Description This function returns MCB block supporting local cid +** Description This function saves MCB block supporting local cid ** *******************************************************************************/ void rfc_save_lcid_mcb (tRFC_MCB *p_mcb, UINT16 lcid) diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c index d3986813c33..60f433dc908 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c @@ -119,6 +119,9 @@ void rfc_mx_sm_execute (tRFC_MCB *p_mcb, UINT16 event, void *p_data) rfc_mx_sm_state_disc_wait_ua (p_mcb, event, p_data); break; + default: + RFCOMM_TRACE_DEBUG("invalid state:%d\n", p_mcb->state); + break; } } @@ -215,7 +218,7 @@ void rfc_mx_sm_state_wait_conn_cnf (tRFC_MCB *p_mcb, UINT16 event, void *p_data) return; /* There is some new timing so that Config Ind comes before security is completed - so we are still waiting fo the confirmation. */ + so we are still waiting for the confirmation. */ case RFC_MX_EVENT_CONF_IND: rfc_mx_conf_ind (p_mcb, (tL2CAP_CFG_INFO *)p_data); return; diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c index a47ade5b4ab..aef37b6120b 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c @@ -597,8 +597,7 @@ void rfc_process_rpn (tRFC_MCB *p_mcb, BOOLEAN is_command, } /* If we are not awaiting response just ignore it */ - p_port = port_find_mcb_dlci_port (p_mcb, p_frame->dlci); - if ((p_port == NULL) || !(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) { + if (!(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) { return; } diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c index 6968de81b17..06f34331719 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c @@ -359,7 +359,7 @@ void RFCOMM_LineStatusReq (tRFC_MCB *p_mcb, UINT8 dlci, UINT8 status) *******************************************************************************/ void RFCOMM_DlcReleaseReq (tRFC_MCB *p_mcb, UINT8 dlci) { - rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, 0); + rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, NULL); } diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c index cbd6e7de8c0..1a715893d3b 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c @@ -527,16 +527,12 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr) UINT8 dlci; BOOLEAN get_dlci = FALSE; tPORT *p_port; - tPORT_CTRL *p_pars; + tPORT_CTRL pars; tRFC_MCB *p_mcb; - if ((p_pars = (tPORT_CTRL *)osi_malloc(sizeof(tPORT_CTRL))) == NULL) { - return; - } - - p_pars->modem_signal = 0; - p_pars->break_signal = 0; - p_pars->fc = TRUE; + pars.modem_signal = 0; + pars.break_signal = 0; + pars.fc = TRUE; p_mcb = port_find_mcb (cert_pts_addr); @@ -549,12 +545,11 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr) } } - if (get_dlci) { - rfc_send_msc(p_mcb, dlci, TRUE, p_pars); + if (get_dlci && p_mcb) { + rfc_send_msc(p_mcb, dlci, TRUE, &pars); } else { RFCOMM_TRACE_ERROR ("Get dlci fail"); } - osi_free(p_pars); } #endif /* BT_RFCOMM_BQB_INCLUDED */ @@ -794,7 +789,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf) RFCOMM_TRACE_ERROR("Illegal MX Frame len:%d < 2", length); osi_free(p_buf); return; - } + } p_rx_frame->ea = *p_data & RFCOMM_EA; p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR; @@ -991,7 +986,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf) if (!ea || !cr || !p_rx_frame->dlci || !RFCOMM_VALID_DLCI (p_rx_frame->dlci)) { - RFCOMM_TRACE_ERROR ("Bad RPN frame"); + RFCOMM_TRACE_ERROR ("Bad RLS frame"); break; } diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c index ee5e1feb568..d3ad4ea7d97 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c @@ -121,6 +121,10 @@ BOOLEAN rfc_check_fcs (UINT16 len, UINT8 *p, UINT8 received_fcs) return (fcs == 0xCF); } +void osi_free_fun(void *p) +{ + osi_free(p); +} /******************************************************************************* ** @@ -168,7 +172,7 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator) p_mcb = &rfc_cb.port.rfc_mcb[j]; if (rfc_cb.port.rfc_mcb[j].state == RFC_MX_STATE_IDLE) { /* New multiplexer control block */ - fixed_queue_free(p_mcb->cmd_q, NULL); + fixed_queue_free(p_mcb->cmd_q, osi_free_fun); rfc_timer_free(p_mcb); memset (p_mcb, 0, sizeof (tRFC_MCB)); memcpy (p_mcb->bd_addr, bd_addr, BD_ADDR_LEN); @@ -188,15 +192,11 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator) return (NULL); } -void osi_free_fun(void *p) -{ - osi_free(p); -} /******************************************************************************* ** ** Function rfc_release_multiplexer_channel ** -** Description This function returns existing or new control block for +** Description This function releases existing control block for ** the BD_ADDR. ** *******************************************************************************/ @@ -299,7 +299,7 @@ void rfc_port_timer_stop (tPORT *p_port) *******************************************************************************/ void rfc_port_timer_free (tPORT *p_port) { - RFCOMM_TRACE_EVENT ("rfc_port_timer_stop"); + RFCOMM_TRACE_EVENT ("rfc_port_timer_free"); btu_free_timer (&p_port->rfc.tle); memset(&p_port->rfc.tle, 0, sizeof(TIMER_LIST_ENT));