Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt_stack): Fix some critical bugs in classic_bt stack

Browse Source 
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
This commit is contained in:
hejiaxin
2026-06-26 14:57:31 +08:00
parent e20d609591
commit 556e7cdad5
20 changed files with 133 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/bt/host/bluedroid/api/esp_hf_client_api.c
View File

@@ -578,9 +578,9 @@ void esp_hf_client_outgoing_data_ready(void)
BTA_HfClientCiData();
}
void esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels)
esp_err_t esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels)
{
BTA_DmPcmInitSamples(src_sps, bits, channels);
return (BTA_DmPcmInitSamples(src_sps, bits, channels) == BTA_SUCCESS) ? ESP_OK : ESP_FAIL;
}
void esp_hf_client_pcm_resample_deinit(void)

6
components/bt/host/bluedroid/api/esp_sdp_api.c
View File

@@ -38,6 +38,12 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
}
break;
case ESP_SDP_TYPE_OPP_SERVER:
if (record->ops.supported_formats_list_len <= 0 || record->ops.supported_formats_list_len > SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH) {
LOG_ERROR("Invalid supported_formats_list_len in record ops!\n");
ret = false;
}
default:
break;
}

4
components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h
View File

@@ -725,8 +725,10 @@ void esp_hf_client_outgoing_data_ready(void);
* @param[in] bits: number of bits per pcm sample (16)
*
* @param[in] channels: number of channels (i.e. mono(1), stereo(2)...)
*
* @return esp_err_t
*/
void esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels);
esp_err_t esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels);
/**
* @brief Deinitialize the down sampling converter.

8
components/bt/host/bluedroid/bta/dm/bta_dm_act.c
View File

@@ -2277,8 +2277,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
}
/* not able to connect go to next device */
osi_free(bta_dm_search_cb.p_sdp_db);
bta_dm_search_cb.p_sdp_db = NULL;
bta_dm_free_sdp_db(NULL);
BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
@@ -2426,6 +2425,7 @@ void bta_dm_free_sdp_db (tBTA_DM_MSG *p_data)
{
UNUSED(p_data);
if (bta_dm_search_cb.p_sdp_db) {
SDP_CancelServiceSearch(bta_dm_search_cb.p_sdp_db);
osi_free(bta_dm_search_cb.p_sdp_db);
bta_dm_search_cb.p_sdp_db = NULL;
}
@@ -2525,6 +2525,7 @@ void bta_dm_search_cancel_transac_cmpl(tBTA_DM_MSG *p_data)
{
UNUSED(p_data);
if (bta_dm_search_cb.p_sdp_db) {
SDP_CancelServiceSearch(bta_dm_search_cb.p_sdp_db);
osi_free(bta_dm_search_cb.p_sdp_db);
bta_dm_search_cb.p_sdp_db = NULL;
}
@@ -2642,8 +2643,7 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
if (!SDP_ServiceSearchAttributeRequest (bd_addr, bta_dm_search_cb.p_sdp_db, &bta_dm_sdp_callback)) {
/* if discovery not successful with this device
proceed to next one */
osi_free(bta_dm_search_cb.p_sdp_db);
bta_dm_search_cb.p_sdp_db = NULL;
bta_dm_free_sdp_db(NULL);
bta_dm_search_cb.service_index = BTA_MAX_SERVICE_ID;
} else {

37
components/bt/host/bluedroid/bta/dm/bta_dm_main.c
View File

@@ -443,20 +443,28 @@ const UINT8 bta_dm_search_idle_st_table[][BTA_DM_SEARCH_NUM_COLS] = {
/* API_SEARCH_CANCEL */ {BTA_DM_SEARCH_CANCEL_NOTIFY, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#if (SDP_INCLUDED == TRUE)
/* API_SEARCH_DISC */ {BTA_DM_API_DISCOVER, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE},
#else
/* API_SEARCH_DISC */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
/* INQUIRY_CMPL */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* REMT_NAME_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#if (SDP_INCLUDED == TRUE)
/* SDP_RESULT_EVT */ {BTA_DM_FREE_SDP_DB, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#else
/* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
/* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* DISCV_RES_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#if (SDP_INCLUDED == TRUE)
/* API_DI_DISCOVER_EVT */ {BTA_DM_API_DI_DISCOVER, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE},
#else
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
#if BLE_INCLUDED == TRUE && SDP_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE && GATTC_INCLUDED == TRUE
// #if BLE_INCLUDED == TRUE
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_CLOSE_GATT_CONN, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#else
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif
};
const UINT8 bta_dm_search_search_active_st_table[][BTA_DM_SEARCH_NUM_COLS] = {
@@ -469,13 +477,17 @@ const UINT8 bta_dm_search_search_active_st_table[][BTA_DM_SEARCH_NUM_COLS] = {
/* REMT_NAME_EVT */ {BTA_DM_REMT_NAME, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE},
#if (SDP_INCLUDED == TRUE)
/* SDP_RESULT_EVT */ {BTA_DM_SDP_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE},
#else
/* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
/* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_CMPL, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* DISCV_RES_EVT */ {BTA_DM_SEARCH_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE},
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE},
#if BLE_INCLUDED == TRUE && SDP_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE && GATTC_INCLUDED == TRUE
// #if BLE_INCLUDED == TRUE
/* DISC_CLOSE_TOUT_EVT */ , {BTA_DM_CLOSE_GATT_CONN, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_CLOSE_GATT_CONN, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE},
#else
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif
};
@@ -487,6 +499,8 @@ const UINT8 bta_dm_search_search_cancelling_st_table[][BTA_DM_SEARCH_NUM_COLS] =
/* API_SEARCH_CANCEL */ {BTA_DM_SEARCH_CLEAR_QUEUE, BTA_DM_SEARCH_CANCEL_NOTIFY, BTA_DM_SEARCH_CANCELLING},
#if (SDP_INCLUDED == TRUE)
/* API_SEARCH_DISC */ {BTA_DM_QUEUE_DISC, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING},
#else
/* API_SEARCH_DISC */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
/* INQUIRY_CMPL */ {BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#if (SDP_INCLUDED == TRUE)
@@ -494,10 +508,17 @@ const UINT8 bta_dm_search_search_cancelling_st_table[][BTA_DM_SEARCH_NUM_COLS] =
/* SDP_RESULT_EVT */ {BTA_DM_SEARCH_CANCEL_TRANSAC_CMPL, BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IDLE},
/* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_CANCEL_TRANSAC_CMPL, BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IDLE},
/* DISCV_RES_EVT */ {BTA_DM_SEARCH_CANCEL_TRANSAC_CMPL, BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IDLE},
#else
/* REMT_NAME_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* DISCV_RES_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING}
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING},
#if BLE_INCLUDED == TRUE
/* DISC_CLOSE_TOUT_EVT */ , {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING}
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING},
#else
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif
};
@@ -512,13 +533,17 @@ const UINT8 bta_dm_search_disc_active_st_table[][BTA_DM_SEARCH_NUM_COLS] = {
/* REMT_NAME_EVT */ {BTA_DM_DISC_RMT_NAME, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE},
#if (SDP_INCLUDED == TRUE)
/* SDP_RESULT_EVT */ {BTA_DM_SDP_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE},
#else
/* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif ///SDP_INCLUDED == TRUE
/* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_CMPL, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
/* DISCV_RES_EVT */ {BTA_DM_DISC_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE},
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}
/* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE},
#if BLE_INCLUDED == TRUE
/* DISC_CLOSE_TOUT_EVT */ , {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE},
#else
/* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE},
#endif
};

11
components/bt/host/bluedroid/bta/dm/bta_dm_sco.c
View File

@@ -558,14 +558,14 @@ INT32 Convert_16S_ToBT_NoFilter (void *pSrc, void *pDst, UINT32 dwSrcSamples, UI
** bits: number of bits per pcm sample (16)
** n_channels: number of channels (i.e. mono(1), stereo(2)...)
**
** Returns none
** Returns tBTA_STATUS
**
*******************************************************************************/
void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels)
tBTA_STATUS BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels)
{
if ((p_bta_dm_pcm_cb = (tBTA_DM_PCM_RESAMPLE_CB *)osi_malloc(sizeof(tBTA_DM_PCM_RESAMPLE_CB))) == NULL) {
APPL_TRACE_ERROR("%s malloc failed!", __func__);
return;
return BTA_FAILURE;
}
tBTA_DM_PCM_RESAMPLE_CB *p_cb = p_bta_dm_pcm_cb;
@@ -620,6 +620,7 @@ void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels)
divisor %d", p_cb->can_be_filtered, p_cb->n_channels, p_cb->divisor);
#endif
return BTA_SUCCESS;
}
/*******************************************************************************
@@ -656,6 +657,10 @@ void BTA_DmPcmDeinitSamples(void) {
**************************************************************************************/
INT32 BTA_DmPcmResample (void *p_src, UINT32 in_bytes, void *p_dst)
{
if (p_bta_dm_pcm_cb == NULL) {
APPL_TRACE_WARNING("p_bta_dm_pcm_cb is NULL");
return 0;
}
UINT32 out_sample;
#if BTA_DM_SCO_DEBUG

4
components/bt/host/bluedroid/bta/include/bta/bta_api.h
View File

@@ -2386,10 +2386,10 @@ extern void bta_dmexecutecallback (tBTA_DM_EXEC_CBACK *p_callback, void *p_param
** bits: number of bits per pcm sample (16)
** n_channels: number of channels (i.e. mono(1), stereo(2)...)
**
** Returns none
** Returns tBTA_STATUS
**
*******************************************************************************/
extern void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels);
extern tBTA_STATUS BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels);
/*******************************************************************************
**

21
components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c
View File

@@ -127,7 +127,6 @@ static void set_sdp_slot_info(int id, int sdp_handle, esp_bt_uuid_t *uuid)
break;
}
slot->sdp_handle = sdp_handle;
slot->record_data = NULL;
if (uuid) {
memcpy(&slot->uuid, uuid, sizeof(esp_bt_uuid_t));
} else {
@@ -216,6 +215,8 @@ static bluetooth_sdp_record *start_create_sdp(int id)
break;
}
record_data = slot->record_data;
// Take this record, preventing alloc_sdp_slot's removal.
slot->record_data = NULL;
} while (0);
osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
@@ -903,11 +904,11 @@ static int btc_handle_create_record_event(int id)
if(sdp_handle != 0) {
set_sdp_slot_info(id, sdp_handle, &service_uuid);
// free the record, since not use it anymore
osi_free(record);
} else {
sdp_handle = -1;
}
// free the record, since not use it anymore
osi_free(record);
} else {
sdp_handle = -1;
}
@@ -1044,6 +1045,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
{
btc_msg_t msg;
bt_status_t status;
UINT16 data_size = sizeof(tBTA_SDP);
switch (event) {
case BTA_SDP_CREATE_RECORD_USER_EVT: {
@@ -1053,6 +1055,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
p_data->sdp_create_record.status = BTA_SDP_FAILURE;
}
}
data_size = sizeof(tBTA_SDP_CREATE_RECORD_USER);
}
break;
case BTA_SDP_REMOVE_RECORD_USER_EVT: {
@@ -1061,6 +1064,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
p_data->sdp_remove_record.status = BTA_SDP_FAILURE;
}
}
data_size = sizeof(tBTA_SDP_REMOVE_RECORD_USER);
}
break;
default:
@@ -1071,7 +1075,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
msg.pid = BTC_PID_SDP;
msg.act = event;
status = btc_transfer_context(&msg, p_data, sizeof(tBTA_SDP), btc_sdp_cb_arg_deep_copy, btc_sdp_cb_arg_deep_free);
status = btc_transfer_context(&msg, p_data, data_size, btc_sdp_cb_arg_deep_copy, btc_sdp_cb_arg_deep_free);
if (status != BT_STATUS_SUCCESS) {
BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__);
@@ -1158,11 +1162,17 @@ static void btc_sdp_create_record(btc_sdp_args_t *arg)
do {
if (!is_sdp_init()) {
BTC_TRACE_ERROR("%s SDP has not been initiated, shall init first!", __func__);
BTC_TRACE_ERROR("SDP shall init first before creating records!");
ret = ESP_SDP_NEED_INIT;
break;
}
if (arg->create_record.record == NULL) {
BTC_TRACE_ERROR("bta sdp record deep copy: no mem");
ret = ESP_SDP_FAILURE;
break;
}
slot_id = alloc_sdp_slot(arg->create_record.record);
if (slot_id < 0) {
ret = ESP_SDP_FAILURE;
@@ -1253,6 +1263,7 @@ void btc_sdp_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
copy_sdp_record(src_record, record);
} else {
BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act);
*dst_record = NULL;
break;
}

19
components/bt/host/bluedroid/stack/rfcomm/port_api.c
View File

@@ -1564,7 +1564,7 @@ int PORT_WriteDataCO (UINT16 handle, int *p_len, int len, UINT8 *p_data)
}
p_buf->offset = L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET;
p_buf->layer_specific = handle;
p_buf->layer_specific = length;
p_buf->len = length;
p_buf->event = BT_EVT_TO_BTU_SP_DATA;
@@ -1648,17 +1648,14 @@ int PORT_WriteData (UINT16 handle, char *p_data, UINT16 max_len, UINT16 *p_len)
return (PORT_UNKNOWN_ERROR);
}
/* Length for each buffer is the smaller of GKI buffer, peer MTU, or max_len */
length = RFCOMM_DATA_BUF_SIZE -
(UINT16)(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + RFCOMM_DATA_OVERHEAD);
/* If there are buffers scheduled for transmission check if requested */
/* data fits into the end of the queue */
osi_mutex_global_lock();
if (((p_buf = (BT_HDR *)fixed_queue_try_peek_last(p_port->tx.queue)) != NULL)
p_buf = (BT_HDR *)fixed_queue_try_peek_last(p_port->tx.queue);
if ((p_buf != NULL)
&& ((p_buf->len + max_len) <= p_port->peer_mtu)
&& ((p_buf->len + max_len) <= length)) {
&& ((p_buf->len + max_len) <= p_buf->layer_specific)) {
memcpy ((UINT8 *)(p_buf + 1) + p_buf->offset + p_buf->len, p_data, max_len);
p_port->tx.queue_size += max_len;
@@ -1686,8 +1683,9 @@ int PORT_WriteData (UINT16 handle, char *p_data, UINT16 max_len, UINT16 *p_len)
}
p_buf->offset = L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET;
p_buf->layer_specific = handle;
p_buf->layer_specific = RFCOMM_DATA_BUF_SIZE - (UINT16)(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + RFCOMM_DATA_OVERHEAD + L2CAP_FCS_LEN);
/* Length for each buffer is the smaller of GKI buffer, peer MTU, or max_len */
length = p_buf->layer_specific;
if (p_port->peer_mtu < length) {
length = p_port->peer_mtu;
}
@@ -1762,7 +1760,8 @@ int PORT_Test (UINT16 handle, UINT8 *p_data, UINT16 len)
return (PORT_NOT_OPENED);
}
if (len > ((p_port->mtu == 0) ? RFCOMM_DEFAULT_MTU : p_port->mtu)) {
if ((len > ((p_port->mtu == 0) ? RFCOMM_DEFAULT_MTU : p_port->mtu))
|| (len > RFCOMM_CMD_BUF_SIZE - sizeof(BT_HDR) - (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2))) {
return (PORT_UNKNOWN_ERROR);
}

3
components/bt/host/bluedroid/stack/sdp/sdp_api.c
View File

@@ -851,6 +851,9 @@ BOOLEAN SDP_FindProfileVersionInRec (tSDP_DISC_REC *p_rec, UINT16 profile_uuid,
/* Now fill in the major and minor numbers */
/* if the attribute matches the description for version (type UINT, size 2 bytes) */
p_sattr = p_sattr->p_next_attr;
if (p_sattr == NULL) {
return (FALSE);
}
if ((SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UINT_DESC_TYPE) &&
(SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 2)) {

12
components/bt/host/bluedroid/stack/sdp/sdp_db.c
View File

@@ -956,9 +956,12 @@ INT32 SDP_ReadRecord(UINT32 handle, UINT8 *p_data, INT32 *p_data_len)
UINT16 start = 0;
UINT16 end = 0xffff;
tSDP_ATTRIBUTE *p_attr;
UINT16 rem_len;
INT32 rem_len;
UINT8 *p_rsp;
if (p_data_len && *p_data_len <= 3) {
return offset;
}
/* Find the record in the database */
p_rec = sdp_db_find_record(handle);
if (p_rec && p_data && p_data_len) {
@@ -967,12 +970,17 @@ INT32 SDP_ReadRecord(UINT32 handle, UINT8 *p_data, INT32 *p_data_len)
/* Check if attribute fits. Assume 3-byte value type/length */
rem_len = *p_data_len - (UINT16) (p_rsp - p_data);
if (p_attr->len > (UINT32)(rem_len - 6)) {
UINT16 required_len = sdpu_get_attrib_entry_len(p_attr);
if (rem_len < (INT32)required_len) {
break;
}
p_rsp = sdpu_build_attrib_entry (p_rsp, p_attr);
// Check overflow
if (p_attr->id == UINT16_MAX) {
break;
}
/* next attr id */
start = p_attr->id + 1;
}

4
components/bt/host/bluedroid/stack/sdp/sdp_main.c
View File

@@ -209,9 +209,11 @@ void sdp_init (void)
void sdp_deinit (void)
{
#if SDP_DYNAMIC_MEMORY == FALSE
list_free(sdp_cb.server_db.p_record_list);
#if SDP_DYNAMIC_MEMORY
#else
if (sdp_cb_ptr) {
list_free(sdp_cb_ptr->server_db.p_record_list);
osi_free(sdp_cb_ptr);
sdp_cb_ptr = NULL;
}

8
components/bt/host/bluedroid/stack/sdp/sdp_server.c
View File

@@ -485,6 +485,10 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
/* If doing a range, stick with this one till no more attributes found */
if (attr_seq.attr_entry[xx].start != attr_seq.attr_entry[xx].end) {
// Check overflow
if (p_attr->id == UINT16_MAX) {
continue;
}
/* Update for next time through */
attr_seq.attr_entry[xx].start = p_attr->id + 1;
@@ -774,6 +778,10 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
/* If doing a range, stick with this one till no more attributes found */
if (attr_seq.attr_entry[xx].start != attr_seq.attr_entry[xx].end) {
// Check overflow
if (p_attr->id == UINT16_MAX) {
continue;
}
/* Update for next time through */
attr_seq.attr_entry[xx].start = p_attr->id + 1;

5
components/bt/host/bluedroid/stack/sdp/sdp_utils.c
View File

@@ -956,6 +956,11 @@ UINT16 sdpu_get_attrib_seq_len(tSDP_RECORD *p_rec, tSDP_ATTR_SEQ *attr_seq)
/* If doing a range, stick with this one till no more attributes found */
if (start_id != end_id) {
// Check overflow
if (p_attr->id == UINT16_MAX) {
is_range = FALSE;
continue;
}
/* Update for next time through */
start_id = p_attr->id + 1;
xx--;

2
components/bt/host/bluedroid/stack/smp/include/smp_int.h
View File

@@ -459,7 +459,7 @@ extern void smp_process_secure_connection_long_term_key(void);
extern void smp_set_local_oob_keys(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern void smp_set_local_oob_random_commitment(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern void smp_set_derive_link_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern BOOLEAN smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern void smp_br_process_pairing_command(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern void smp_br_process_security_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);
extern void smp_br_process_slave_keys_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data);

14
components/bt/host/bluedroid/stack/smp/p_256_multprecision.c
View File

@@ -429,7 +429,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[1] < UU);
U = 0 - (a[1] < UU);
c[1] = a[1] - UU;
} else {
c[1] = a[1] + U;
@@ -446,7 +446,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[2] < UU);
U = 0 - (a[2] < UU);
c[2] = a[2] - UU;
} else {
c[2] = a[2] + U;
@@ -463,7 +463,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[3] < UU);
U = 0 - (a[3] < UU);
c[3] = a[3] - UU;
} else {
c[3] = a[3] + U;
@@ -488,7 +488,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[4] < UU);
U = 0 - (a[4] < UU);
c[4] = a[4] - UU;
} else {
c[4] = a[4] + U;
@@ -511,7 +511,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[5] < UU);
U = 0 - (a[5] < UU);
c[5] = a[5] - UU;
} else {
c[5] = a[5] + U;
@@ -532,7 +532,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[6] < UU);
U = 0 - (a[6] < UU);
c[6] = a[6] - UU;
} else {
c[6] = a[6] + U;
@@ -555,7 +555,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a)
if (U & 0x80000000) {
DWORD UU;
UU = 0 - U;
U = (a[7] < UU);
U = 0 - (a[7] < UU);
c[7] = a[7] - UU;
} else {
c[7] = a[7] + U;

11
components/bt/host/bluedroid/stack/smp/smp_act.c
View File

@@ -1481,7 +1481,9 @@ void smp_key_distribution(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
SMP_TRACE_DEBUG("%s BREDR key is higher security than existing LE keys, "
"don't derive LK from LTK", __func__);
} else {
smp_derive_link_key_from_long_term_key(p_cb, NULL);
if (!smp_derive_link_key_from_long_term_key(p_cb, NULL)){
return;
}
}
p_cb->derive_lk = FALSE;
}
@@ -2281,10 +2283,10 @@ void smp_set_derive_link_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
**
** Description This function is called to derive BR/EDR LK from LTK.
**
** Returns void
** Returns BOOLEAN
**
*******************************************************************************/
void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
BOOLEAN smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
{
tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
@@ -2292,8 +2294,9 @@ void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data
if (!smp_calculate_link_key_from_long_term_key(p_cb)) {
SMP_TRACE_ERROR("%s failed\n", __FUNCTION__);
smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
return;
return FALSE;
}
return TRUE;
}
#endif ///BLE_INCLUDED == TRUE

2
components/bt/host/bluedroid/stack/smp/smp_api.c
View File

@@ -217,7 +217,7 @@ tSMP_STATUS SMP_BR_PairWith (BD_ADDR bd_addr)
if (!L2CA_ConnectFixedChnl (L2CAP_SMP_BR_CID, bd_addr, BLE_ADDR_UNKNOWN_TYPE, FALSE, FALSE, 0xFF, 0xFF)) {
SMP_TRACE_ERROR("%s: L2C connect fixed channel failed.", __FUNCTION__);
smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &status);
smp_reset_control_value(p_cb);
return status;
}

4
components/bt/host/bluedroid/stack/smp/smp_cmac.c
View File

@@ -458,8 +458,8 @@ BOOLEAN aes_cipher_msg_auth_code(BT_OCTET16 key, UINT8 *input, UINT16 length,
}
#else
{
UINT16 len, diff;
UINT16 n = (length + BT_OCTET16_LEN - 1) / BT_OCTET16_LEN;
UINT32 len, diff;
UINT32 n = (length + BT_OCTET16_LEN - 1) / BT_OCTET16_LEN;
if (n == 0) {
n = 1;

5
components/bt/host/bluedroid/stack/smp/smp_main.c
View File

@@ -730,6 +730,11 @@ void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data)
UINT8 curr_state = p_cb->state;
tSMP_SM_TBL state_table;
UINT8 action, entry, i;
if (p_cb->role > 1) {
SMP_TRACE_ERROR( "Invalid role\n") ;
return;
}
tSMP_ENTRY_TBL entry_table = smp_entry_table[p_cb->role];
SMP_TRACE_EVENT("main smp_sm_event\n");