diff --git a/components/bt/host/bluedroid/api/esp_hf_client_api.c b/components/bt/host/bluedroid/api/esp_hf_client_api.c index 2968095b2ac..7b966099785 100644 --- a/components/bt/host/bluedroid/api/esp_hf_client_api.c +++ b/components/bt/host/bluedroid/api/esp_hf_client_api.c @@ -578,9 +578,9 @@ void esp_hf_client_outgoing_data_ready(void) BTA_HfClientCiData(); } -void esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels) +esp_err_t esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels) { - BTA_DmPcmInitSamples(src_sps, bits, channels); + return (BTA_DmPcmInitSamples(src_sps, bits, channels) == BTA_SUCCESS) ? ESP_OK : ESP_FAIL; } void esp_hf_client_pcm_resample_deinit(void) diff --git a/components/bt/host/bluedroid/api/esp_sdp_api.c b/components/bt/host/bluedroid/api/esp_sdp_api.c index 2a796995d5f..eff80444bc9 100644 --- a/components/bt/host/bluedroid/api/esp_sdp_api.c +++ b/components/bt/host/bluedroid/api/esp_sdp_api.c @@ -38,6 +38,12 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record) } break; + case ESP_SDP_TYPE_OPP_SERVER: + if (record->ops.supported_formats_list_len <= 0 || record->ops.supported_formats_list_len > SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH) { + LOG_ERROR("Invalid supported_formats_list_len in record ops!\n"); + ret = false; + } + default: break; } diff --git a/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h b/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h index 3d50fcc4406..b9e0356182b 100644 --- a/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h +++ b/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h @@ -725,8 +725,10 @@ void esp_hf_client_outgoing_data_ready(void); * @param[in] bits: number of bits per pcm sample (16) * * @param[in] channels: number of channels (i.e. mono(1), stereo(2)...) + * + * @return esp_err_t */ -void esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels); +esp_err_t esp_hf_client_pcm_resample_init(uint32_t src_sps, uint32_t bits, uint32_t channels); /** * @brief Deinitialize the down sampling converter. diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c index f20079c8d84..4f327b2b33b 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c @@ -2294,8 +2294,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data) } /* not able to connect go to next device */ - osi_free(bta_dm_search_cb.p_sdp_db); - bta_dm_search_cb.p_sdp_db = NULL; + bta_dm_free_sdp_db(NULL); BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback); @@ -2443,6 +2442,7 @@ void bta_dm_free_sdp_db (tBTA_DM_MSG *p_data) { UNUSED(p_data); if (bta_dm_search_cb.p_sdp_db) { + SDP_CancelServiceSearch(bta_dm_search_cb.p_sdp_db); osi_free(bta_dm_search_cb.p_sdp_db); bta_dm_search_cb.p_sdp_db = NULL; } @@ -2542,6 +2542,7 @@ void bta_dm_search_cancel_transac_cmpl(tBTA_DM_MSG *p_data) { UNUSED(p_data); if (bta_dm_search_cb.p_sdp_db) { + SDP_CancelServiceSearch(bta_dm_search_cb.p_sdp_db); osi_free(bta_dm_search_cb.p_sdp_db); bta_dm_search_cb.p_sdp_db = NULL; } @@ -2659,8 +2660,7 @@ static void bta_dm_find_services ( BD_ADDR bd_addr) if (!SDP_ServiceSearchAttributeRequest (bd_addr, bta_dm_search_cb.p_sdp_db, &bta_dm_sdp_callback)) { /* if discovery not successful with this device proceed to next one */ - osi_free(bta_dm_search_cb.p_sdp_db); - bta_dm_search_cb.p_sdp_db = NULL; + bta_dm_free_sdp_db(NULL); bta_dm_search_cb.service_index = BTA_MAX_SERVICE_ID; } else { diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c index 2ee25451264..32cea21ddc2 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c @@ -449,20 +449,28 @@ const UINT8 bta_dm_search_idle_st_table[][BTA_DM_SEARCH_NUM_COLS] = { /* API_SEARCH_CANCEL */ {BTA_DM_SEARCH_CANCEL_NOTIFY, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #if (SDP_INCLUDED == TRUE) /* API_SEARCH_DISC */ {BTA_DM_API_DISCOVER, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}, +#else + /* API_SEARCH_DISC */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE /* INQUIRY_CMPL */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, /* REMT_NAME_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #if (SDP_INCLUDED == TRUE) /* SDP_RESULT_EVT */ {BTA_DM_FREE_SDP_DB, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, +#else + /* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE /* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, /* DISCV_RES_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #if (SDP_INCLUDED == TRUE) /* API_DI_DISCOVER_EVT */ {BTA_DM_API_DI_DISCOVER, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}, +#else + /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE #if BLE_INCLUDED == TRUE && SDP_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE && GATTC_INCLUDED == TRUE // #if BLE_INCLUDED == TRUE /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_CLOSE_GATT_CONN, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, +#else + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif }; const UINT8 bta_dm_search_search_active_st_table[][BTA_DM_SEARCH_NUM_COLS] = { @@ -475,13 +483,17 @@ const UINT8 bta_dm_search_search_active_st_table[][BTA_DM_SEARCH_NUM_COLS] = { /* REMT_NAME_EVT */ {BTA_DM_REMT_NAME, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}, #if (SDP_INCLUDED == TRUE) /* SDP_RESULT_EVT */ {BTA_DM_SDP_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}, +#else + /* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE /* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_CMPL, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, /* DISCV_RES_EVT */ {BTA_DM_SEARCH_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}, - /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE} + /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}, #if BLE_INCLUDED == TRUE && SDP_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE && GATTC_INCLUDED == TRUE // #if BLE_INCLUDED == TRUE - /* DISC_CLOSE_TOUT_EVT */ , {BTA_DM_CLOSE_GATT_CONN, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE} + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_CLOSE_GATT_CONN, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_ACTIVE}, +#else + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif }; @@ -493,6 +505,8 @@ const UINT8 bta_dm_search_search_cancelling_st_table[][BTA_DM_SEARCH_NUM_COLS] = /* API_SEARCH_CANCEL */ {BTA_DM_SEARCH_CLEAR_QUEUE, BTA_DM_SEARCH_CANCEL_NOTIFY, BTA_DM_SEARCH_CANCELLING}, #if (SDP_INCLUDED == TRUE) /* API_SEARCH_DISC */ {BTA_DM_QUEUE_DISC, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING}, +#else + /* API_SEARCH_DISC */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE /* INQUIRY_CMPL */ {BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #if (SDP_INCLUDED == TRUE) @@ -500,10 +514,17 @@ const UINT8 bta_dm_search_search_cancelling_st_table[][BTA_DM_SEARCH_NUM_COLS] = /* SDP_RESULT_EVT */ {BTA_DM_SEARCH_CANCEL_TRANSAC_CMPL, BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IDLE}, /* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_CANCEL_TRANSAC_CMPL, BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IDLE}, /* DISCV_RES_EVT */ {BTA_DM_SEARCH_CANCEL_TRANSAC_CMPL, BTA_DM_SEARCH_CANCEL_CMPL, BTA_DM_SEARCH_IDLE}, +#else + /* REMT_NAME_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, + /* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, + /* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, + /* DISCV_RES_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE - /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING} + /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING}, #if BLE_INCLUDED == TRUE - /* DISC_CLOSE_TOUT_EVT */ , {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING} + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_CANCELLING}, +#else + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif }; @@ -518,13 +539,17 @@ const UINT8 bta_dm_search_disc_active_st_table[][BTA_DM_SEARCH_NUM_COLS] = { /* REMT_NAME_EVT */ {BTA_DM_DISC_RMT_NAME, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}, #if (SDP_INCLUDED == TRUE) /* SDP_RESULT_EVT */ {BTA_DM_SDP_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}, +#else + /* SDP_RESULT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif ///SDP_INCLUDED == TRUE /* SEARCH_CMPL_EVT */ {BTA_DM_SEARCH_CMPL, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, /* DISCV_RES_EVT */ {BTA_DM_DISC_RESULT, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}, - /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE} + /* API_DI_DISCOVER_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}, #if BLE_INCLUDED == TRUE - /* DISC_CLOSE_TOUT_EVT */ , {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE} + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_DISCOVER_ACTIVE}, +#else + /* DISC_CLOSE_TOUT_EVT */ {BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IGNORE, BTA_DM_SEARCH_IDLE}, #endif }; diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c b/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c index 513376ca5ef..b52435adb1d 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c @@ -558,14 +558,14 @@ INT32 Convert_16S_ToBT_NoFilter (void *pSrc, void *pDst, UINT32 dwSrcSamples, UI ** bits: number of bits per pcm sample (16) ** n_channels: number of channels (i.e. mono(1), stereo(2)...) ** -** Returns none +** Returns tBTA_STATUS ** *******************************************************************************/ -void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels) +tBTA_STATUS BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels) { if ((p_bta_dm_pcm_cb = (tBTA_DM_PCM_RESAMPLE_CB *)osi_malloc(sizeof(tBTA_DM_PCM_RESAMPLE_CB))) == NULL) { APPL_TRACE_ERROR("%s malloc failed!", __func__); - return; + return BTA_FAILURE; } tBTA_DM_PCM_RESAMPLE_CB *p_cb = p_bta_dm_pcm_cb; @@ -620,6 +620,7 @@ void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels) divisor %d", p_cb->can_be_filtered, p_cb->n_channels, p_cb->divisor); #endif + return BTA_SUCCESS; } /******************************************************************************* @@ -656,6 +657,10 @@ void BTA_DmPcmDeinitSamples(void) { **************************************************************************************/ INT32 BTA_DmPcmResample (void *p_src, UINT32 in_bytes, void *p_dst) { + if (p_bta_dm_pcm_cb == NULL) { + APPL_TRACE_WARNING("p_bta_dm_pcm_cb is NULL"); + return 0; + } UINT32 out_sample; #if BTA_DM_SCO_DEBUG diff --git a/components/bt/host/bluedroid/bta/include/bta/bta_api.h b/components/bt/host/bluedroid/bta/include/bta/bta_api.h index 42672924a67..3c558f6dcd7 100644 --- a/components/bt/host/bluedroid/bta/include/bta/bta_api.h +++ b/components/bt/host/bluedroid/bta/include/bta/bta_api.h @@ -2404,10 +2404,10 @@ extern void bta_dmexecutecallback (tBTA_DM_EXEC_CBACK *p_callback, void *p_param ** bits: number of bits per pcm sample (16) ** n_channels: number of channels (i.e. mono(1), stereo(2)...) ** -** Returns none +** Returns tBTA_STATUS ** *******************************************************************************/ -extern void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels); +extern tBTA_STATUS BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels); /******************************************************************************* ** diff --git a/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c b/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c index d738c898f40..cd469ffeb45 100644 --- a/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c +++ b/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c @@ -127,7 +127,6 @@ static void set_sdp_slot_info(int id, int sdp_handle, esp_bt_uuid_t *uuid) break; } slot->sdp_handle = sdp_handle; - slot->record_data = NULL; if (uuid) { memcpy(&slot->uuid, uuid, sizeof(esp_bt_uuid_t)); } else { @@ -216,6 +215,8 @@ static bluetooth_sdp_record *start_create_sdp(int id) break; } record_data = slot->record_data; + // Take this record, preventing alloc_sdp_slot's removal. + slot->record_data = NULL; } while (0); osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex); @@ -903,11 +904,11 @@ static int btc_handle_create_record_event(int id) if(sdp_handle != 0) { set_sdp_slot_info(id, sdp_handle, &service_uuid); - // free the record, since not use it anymore - osi_free(record); } else { sdp_handle = -1; } + // free the record, since not use it anymore + osi_free(record); } else { sdp_handle = -1; } @@ -1044,6 +1045,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da { btc_msg_t msg; bt_status_t status; + UINT16 data_size = sizeof(tBTA_SDP); switch (event) { case BTA_SDP_CREATE_RECORD_USER_EVT: { @@ -1053,6 +1055,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da p_data->sdp_create_record.status = BTA_SDP_FAILURE; } } + data_size = sizeof(tBTA_SDP_CREATE_RECORD_USER); } break; case BTA_SDP_REMOVE_RECORD_USER_EVT: { @@ -1061,6 +1064,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da p_data->sdp_remove_record.status = BTA_SDP_FAILURE; } } + data_size = sizeof(tBTA_SDP_REMOVE_RECORD_USER); } break; default: @@ -1071,7 +1075,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da msg.pid = BTC_PID_SDP; msg.act = event; - status = btc_transfer_context(&msg, p_data, sizeof(tBTA_SDP), btc_sdp_cb_arg_deep_copy, btc_sdp_cb_arg_deep_free); + status = btc_transfer_context(&msg, p_data, data_size, btc_sdp_cb_arg_deep_copy, btc_sdp_cb_arg_deep_free); if (status != BT_STATUS_SUCCESS) { BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__); @@ -1158,11 +1162,17 @@ static void btc_sdp_create_record(btc_sdp_args_t *arg) do { if (!is_sdp_init()) { - BTC_TRACE_ERROR("%s SDP has not been initiated, shall init first!", __func__); + BTC_TRACE_ERROR("SDP shall init first before creating records!"); ret = ESP_SDP_NEED_INIT; break; } + if (arg->create_record.record == NULL) { + BTC_TRACE_ERROR("bta sdp record deep copy: no mem"); + ret = ESP_SDP_FAILURE; + break; + } + slot_id = alloc_sdp_slot(arg->create_record.record); if (slot_id < 0) { ret = ESP_SDP_FAILURE; @@ -1253,6 +1263,7 @@ void btc_sdp_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) copy_sdp_record(src_record, record); } else { BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act); + *dst_record = NULL; break; } diff --git a/components/bt/host/bluedroid/stack/rfcomm/port_api.c b/components/bt/host/bluedroid/stack/rfcomm/port_api.c index b09e89d158f..53c83b87372 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/port_api.c +++ b/components/bt/host/bluedroid/stack/rfcomm/port_api.c @@ -1564,7 +1564,7 @@ int PORT_WriteDataCO (UINT16 handle, int *p_len, int len, UINT8 *p_data) } p_buf->offset = L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET; - p_buf->layer_specific = handle; + p_buf->layer_specific = length; p_buf->len = length; p_buf->event = BT_EVT_TO_BTU_SP_DATA; @@ -1648,17 +1648,14 @@ int PORT_WriteData (UINT16 handle, char *p_data, UINT16 max_len, UINT16 *p_len) return (PORT_UNKNOWN_ERROR); } - /* Length for each buffer is the smaller of GKI buffer, peer MTU, or max_len */ - length = RFCOMM_DATA_BUF_SIZE - - (UINT16)(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + RFCOMM_DATA_OVERHEAD); /* If there are buffers scheduled for transmission check if requested */ /* data fits into the end of the queue */ osi_mutex_global_lock(); - - if (((p_buf = (BT_HDR *)fixed_queue_try_peek_last(p_port->tx.queue)) != NULL) + p_buf = (BT_HDR *)fixed_queue_try_peek_last(p_port->tx.queue); + if ((p_buf != NULL) && ((p_buf->len + max_len) <= p_port->peer_mtu) - && ((p_buf->len + max_len) <= length)) { + && ((p_buf->len + max_len) <= p_buf->layer_specific)) { memcpy ((UINT8 *)(p_buf + 1) + p_buf->offset + p_buf->len, p_data, max_len); p_port->tx.queue_size += max_len; @@ -1686,8 +1683,9 @@ int PORT_WriteData (UINT16 handle, char *p_data, UINT16 max_len, UINT16 *p_len) } p_buf->offset = L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET; - p_buf->layer_specific = handle; - + p_buf->layer_specific = RFCOMM_DATA_BUF_SIZE - (UINT16)(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + RFCOMM_DATA_OVERHEAD + L2CAP_FCS_LEN); + /* Length for each buffer is the smaller of GKI buffer, peer MTU, or max_len */ + length = p_buf->layer_specific; if (p_port->peer_mtu < length) { length = p_port->peer_mtu; } @@ -1762,7 +1760,8 @@ int PORT_Test (UINT16 handle, UINT8 *p_data, UINT16 len) return (PORT_NOT_OPENED); } - if (len > ((p_port->mtu == 0) ? RFCOMM_DEFAULT_MTU : p_port->mtu)) { + if ((len > ((p_port->mtu == 0) ? RFCOMM_DEFAULT_MTU : p_port->mtu)) + || (len > RFCOMM_CMD_BUF_SIZE - sizeof(BT_HDR) - (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2))) { return (PORT_UNKNOWN_ERROR); } diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_api.c b/components/bt/host/bluedroid/stack/sdp/sdp_api.c index 0c76ece099b..100d1108d7b 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_api.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_api.c @@ -851,6 +851,9 @@ BOOLEAN SDP_FindProfileVersionInRec (tSDP_DISC_REC *p_rec, UINT16 profile_uuid, /* Now fill in the major and minor numbers */ /* if the attribute matches the description for version (type UINT, size 2 bytes) */ p_sattr = p_sattr->p_next_attr; + if (p_sattr == NULL) { + return (FALSE); + } if ((SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UINT_DESC_TYPE) && (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 2)) { diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_db.c b/components/bt/host/bluedroid/stack/sdp/sdp_db.c index 88d84071d0b..8ff0afd078e 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_db.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_db.c @@ -956,9 +956,12 @@ INT32 SDP_ReadRecord(UINT32 handle, UINT8 *p_data, INT32 *p_data_len) UINT16 start = 0; UINT16 end = 0xffff; tSDP_ATTRIBUTE *p_attr; - UINT16 rem_len; + INT32 rem_len; UINT8 *p_rsp; + if (p_data_len && *p_data_len <= 3) { + return offset; + } /* Find the record in the database */ p_rec = sdp_db_find_record(handle); if (p_rec && p_data && p_data_len) { @@ -967,12 +970,17 @@ INT32 SDP_ReadRecord(UINT32 handle, UINT8 *p_data, INT32 *p_data_len) /* Check if attribute fits. Assume 3-byte value type/length */ rem_len = *p_data_len - (UINT16) (p_rsp - p_data); - if (p_attr->len > (UINT32)(rem_len - 6)) { + UINT16 required_len = sdpu_get_attrib_entry_len(p_attr); + if (rem_len < (INT32)required_len) { break; } p_rsp = sdpu_build_attrib_entry (p_rsp, p_attr); + // Check overflow + if (p_attr->id == UINT16_MAX) { + break; + } /* next attr id */ start = p_attr->id + 1; } diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_main.c b/components/bt/host/bluedroid/stack/sdp/sdp_main.c index 11309caec38..d9a07902fa6 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_main.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_main.c @@ -209,9 +209,11 @@ void sdp_init (void) void sdp_deinit (void) { +#if SDP_DYNAMIC_MEMORY == FALSE list_free(sdp_cb.server_db.p_record_list); -#if SDP_DYNAMIC_MEMORY +#else if (sdp_cb_ptr) { + list_free(sdp_cb_ptr->server_db.p_record_list); osi_free(sdp_cb_ptr); sdp_cb_ptr = NULL; } diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_server.c b/components/bt/host/bluedroid/stack/sdp/sdp_server.c index 645e175ea5f..3523ccbb93d 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_server.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_server.c @@ -485,6 +485,10 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* If doing a range, stick with this one till no more attributes found */ if (attr_seq.attr_entry[xx].start != attr_seq.attr_entry[xx].end) { + // Check overflow + if (p_attr->id == UINT16_MAX) { + continue; + } /* Update for next time through */ attr_seq.attr_entry[xx].start = p_attr->id + 1; @@ -774,6 +778,10 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* If doing a range, stick with this one till no more attributes found */ if (attr_seq.attr_entry[xx].start != attr_seq.attr_entry[xx].end) { + // Check overflow + if (p_attr->id == UINT16_MAX) { + continue; + } /* Update for next time through */ attr_seq.attr_entry[xx].start = p_attr->id + 1; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_utils.c b/components/bt/host/bluedroid/stack/sdp/sdp_utils.c index 4ded1162707..8b91b36cc94 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_utils.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_utils.c @@ -956,6 +956,11 @@ UINT16 sdpu_get_attrib_seq_len(tSDP_RECORD *p_rec, tSDP_ATTR_SEQ *attr_seq) /* If doing a range, stick with this one till no more attributes found */ if (start_id != end_id) { + // Check overflow + if (p_attr->id == UINT16_MAX) { + is_range = FALSE; + continue; + } /* Update for next time through */ start_id = p_attr->id + 1; xx--; diff --git a/components/bt/host/bluedroid/stack/smp/include/smp_int.h b/components/bt/host/bluedroid/stack/smp/include/smp_int.h index 0c0ac676bed..22522d9a4d8 100644 --- a/components/bt/host/bluedroid/stack/smp/include/smp_int.h +++ b/components/bt/host/bluedroid/stack/smp/include/smp_int.h @@ -459,7 +459,7 @@ extern void smp_process_secure_connection_long_term_key(void); extern void smp_set_local_oob_keys(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_set_local_oob_random_commitment(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_set_derive_link_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); -extern void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); +extern BOOLEAN smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_br_process_pairing_command(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_br_process_security_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_br_process_slave_keys_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); diff --git a/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c b/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c index d0a45a247c6..a38f4dc73a9 100644 --- a/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c +++ b/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c @@ -429,7 +429,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[1] < UU); + U = 0 - (a[1] < UU); c[1] = a[1] - UU; } else { c[1] = a[1] + U; @@ -446,7 +446,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[2] < UU); + U = 0 - (a[2] < UU); c[2] = a[2] - UU; } else { c[2] = a[2] + U; @@ -463,7 +463,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[3] < UU); + U = 0 - (a[3] < UU); c[3] = a[3] - UU; } else { c[3] = a[3] + U; @@ -488,7 +488,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[4] < UU); + U = 0 - (a[4] < UU); c[4] = a[4] - UU; } else { c[4] = a[4] + U; @@ -511,7 +511,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[5] < UU); + U = 0 - (a[5] < UU); c[5] = a[5] - UU; } else { c[5] = a[5] + U; @@ -532,7 +532,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[6] < UU); + U = 0 - (a[6] < UU); c[6] = a[6] - UU; } else { c[6] = a[6] + U; @@ -555,7 +555,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) if (U & 0x80000000) { DWORD UU; UU = 0 - U; - U = (a[7] < UU); + U = 0 - (a[7] < UU); c[7] = a[7] - UU; } else { c[7] = a[7] + U; diff --git a/components/bt/host/bluedroid/stack/smp/smp_act.c b/components/bt/host/bluedroid/stack/smp/smp_act.c index cf485db8344..ce71f41cf73 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_act.c +++ b/components/bt/host/bluedroid/stack/smp/smp_act.c @@ -1481,7 +1481,9 @@ void smp_key_distribution(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) SMP_TRACE_DEBUG("%s BREDR key is higher security than existing LE keys, " "don't derive LK from LTK", __func__); } else { - smp_derive_link_key_from_long_term_key(p_cb, NULL); + if (!smp_derive_link_key_from_long_term_key(p_cb, NULL)){ + return; + } } p_cb->derive_lk = FALSE; } @@ -2281,10 +2283,10 @@ void smp_set_derive_link_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) ** ** Description This function is called to derive BR/EDR LK from LTK. ** -** Returns void +** Returns BOOLEAN ** *******************************************************************************/ -void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) +BOOLEAN smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN; @@ -2292,8 +2294,9 @@ void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data if (!smp_calculate_link_key_from_long_term_key(p_cb)) { SMP_TRACE_ERROR("%s failed\n", __FUNCTION__); smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); - return; + return FALSE; } + return TRUE; } #endif ///BLE_INCLUDED == TRUE diff --git a/components/bt/host/bluedroid/stack/smp/smp_api.c b/components/bt/host/bluedroid/stack/smp/smp_api.c index e91f4fe619b..772c0d2c9b0 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_api.c +++ b/components/bt/host/bluedroid/stack/smp/smp_api.c @@ -217,7 +217,7 @@ tSMP_STATUS SMP_BR_PairWith (BD_ADDR bd_addr) if (!L2CA_ConnectFixedChnl (L2CAP_SMP_BR_CID, bd_addr, BLE_ADDR_UNKNOWN_TYPE, FALSE, FALSE, 0xFF, 0xFF)) { SMP_TRACE_ERROR("%s: L2C connect fixed channel failed.", __FUNCTION__); - smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &status); + smp_reset_control_value(p_cb); return status; } diff --git a/components/bt/host/bluedroid/stack/smp/smp_cmac.c b/components/bt/host/bluedroid/stack/smp/smp_cmac.c index e58e28ebcbd..a716a403342 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_cmac.c +++ b/components/bt/host/bluedroid/stack/smp/smp_cmac.c @@ -458,8 +458,8 @@ BOOLEAN aes_cipher_msg_auth_code(BT_OCTET16 key, UINT8 *input, UINT16 length, } #else { - UINT16 len, diff; - UINT16 n = (length + BT_OCTET16_LEN - 1) / BT_OCTET16_LEN; + UINT32 len, diff; + UINT32 n = (length + BT_OCTET16_LEN - 1) / BT_OCTET16_LEN; if (n == 0) { n = 1; diff --git a/components/bt/host/bluedroid/stack/smp/smp_main.c b/components/bt/host/bluedroid/stack/smp/smp_main.c index fd9bc0c6d7e..1dd73136af8 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_main.c +++ b/components/bt/host/bluedroid/stack/smp/smp_main.c @@ -730,6 +730,11 @@ void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data) UINT8 curr_state = p_cb->state; tSMP_SM_TBL state_table; UINT8 action, entry, i; + + if (p_cb->role > 1) { + SMP_TRACE_ERROR( "Invalid role\n") ; + return; + } tSMP_ENTRY_TBL entry_table = smp_entry_table[p_cb->role]; SMP_TRACE_EVENT("main smp_sm_event\n");