Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/smp_sec_flags_v6.1' into 'release/v6.1'

Browse Source 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v6.1)

See merge request espressif/esp-idf!50565
This commit is contained in:
Jiang Jiang Jian
2026-07-16 11:35:17 +08:00
parent 8346b7596e e4c999e891
commit 64218b5dd3
4 changed files with 138 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c
View File

@@ -1407,10 +1407,11 @@ void btc_hh_cb_handler(btc_msg_t *msg)
BTA_DmRemoveDevice(p_dev->bd_addr, BT_TRANSPORT_BR_EDR);
#endif
btc_hh_remove_device(p_dev->bd_addr);
} else {
p_dev->dev_status = ESP_HIDH_CONN_STATE_DISCONNECTED;
}
btc_hh_cb.status = (BTC_HH_STATUS)BTC_HH_DEV_DISCONNECTED;
p_dev->dev_status = ESP_HIDH_CONN_STATE_DISCONNECTED;
param.close.status = p_data->dev_status.status;
} else {
BTC_TRACE_ERROR("Error: cannot find device with handle %d", p_data->dev_status.handle);

92
components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c
View File

@@ -716,26 +716,51 @@ void btc_pba_client_call_handler(btc_msg_t *msg)
}
}
static bool btc_pba_client_app_param_tag_valid(const uint8_t *ptr, const uint8_t *end, uint8_t value_len)
{
if (ptr + BTA_PBAP_APP_PARAM_HEADER_LENGTH > end) {
return false;
}
if (ptr[1] != value_len) {
return false;
}
return (ptr + BTA_PBAP_APP_PARAM_HEADER_LENGTH + value_len <= end);
}
static void parse_pull_phone_book_app_param(esp_pbac_param_t *param, uint8_t *app_param, uint16_t app_param_len)
{
if (app_param == NULL || app_param_len == 0) {
return;
}
uint8_t *ptr = app_param;
while(ptr < app_param + app_param_len) {
const uint8_t *end = app_param + app_param_len;
while (ptr < end) {
switch (*ptr)
{
case BTA_PBAP_APP_PARAM_PHONE_BOOK_SIZE:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_PHONE_BOOK_SIZE)) {
goto error;
}
param->pull_phone_book_rsp.include_phone_book_size = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
BE_STREAM_TO_UINT16(param->pull_phone_book_rsp.phone_book_size, ptr);
break;
case BTA_PBAP_APP_PARAM_NEW_MISSED_CALLS:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_NEW_MISSED_CALLS)) {
goto error;
}
param->pull_phone_book_rsp.include_new_missed_calls = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
BE_STREAM_TO_UINT8(param->pull_phone_book_rsp.new_missed_calls, ptr);
break;
case BTA_PBAP_APP_PARAM_PRIMARY_FOLDER_VERSION:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_PRIMARY_FOLDER_VERSION)) {
goto error;
}
param->pull_phone_book_rsp.include_primary_folder_version = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -743,6 +768,9 @@ static void parse_pull_phone_book_app_param(esp_pbac_param_t *param, uint8_t *ap
ptr += BTA_PBAP_APP_PARAM_LENGTH_PRIMARY_FOLDER_VERSION;
break;
case BTA_PBAP_APP_PARAM_SECONDARY_FOLDER_VERSION:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_SECONDARY_FOLDER_VERSION)) {
goto error;
}
param->pull_phone_book_rsp.include_secondary_folder_version = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -750,6 +778,9 @@ static void parse_pull_phone_book_app_param(esp_pbac_param_t *param, uint8_t *ap
ptr += BTA_PBAP_APP_PARAM_LENGTH_SECONDARY_FOLDER_VERSION;
break;
case BTA_PBAP_APP_PARAM_DATABASE_IDENTIFIER:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_DATABASE_IDENTIFIER)) {
goto error;
}
param->pull_phone_book_rsp.include_database_identifier = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -761,8 +792,19 @@ static void parse_pull_phone_book_app_param(esp_pbac_param_t *param, uint8_t *ap
break;
}
}
error:
return;
error:
param->pull_phone_book_rsp.include_phone_book_size = 0;
param->pull_phone_book_rsp.phone_book_size = 0;
param->pull_phone_book_rsp.include_new_missed_calls = 0;
param->pull_phone_book_rsp.new_missed_calls = 0;
param->pull_phone_book_rsp.include_primary_folder_version = 0;
param->pull_phone_book_rsp.primary_folder_version = NULL;
param->pull_phone_book_rsp.include_secondary_folder_version = 0;
param->pull_phone_book_rsp.secondary_folder_version = NULL;
param->pull_phone_book_rsp.include_database_identifier = 0;
param->pull_phone_book_rsp.database_identifier = NULL;
}
static void parse_pull_vcard_listing_app_param(esp_pbac_param_t *param, uint8_t *app_param, uint16_t app_param_len)
@@ -770,21 +812,33 @@ static void parse_pull_vcard_listing_app_param(esp_pbac_param_t *param, uint8_t
if (app_param == NULL || app_param_len == 0) {
return;
}
uint8_t *ptr = app_param;
while(ptr < app_param + app_param_len) {
const uint8_t *end = app_param + app_param_len;
while (ptr < end) {
switch (*ptr)
{
case BTA_PBAP_APP_PARAM_PHONE_BOOK_SIZE:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_PHONE_BOOK_SIZE)) {
goto error;
}
param->pull_vcard_listing_rsp.include_phone_book_size = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
BE_STREAM_TO_UINT16(param->pull_vcard_listing_rsp.phone_book_size, ptr);
break;
case BTA_PBAP_APP_PARAM_NEW_MISSED_CALLS:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_NEW_MISSED_CALLS)) {
goto error;
}
param->pull_vcard_listing_rsp.include_new_missed_calls = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
BE_STREAM_TO_UINT8(param->pull_vcard_listing_rsp.new_missed_calls, ptr);
break;
case BTA_PBAP_APP_PARAM_PRIMARY_FOLDER_VERSION:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_PRIMARY_FOLDER_VERSION)) {
goto error;
}
param->pull_vcard_listing_rsp.include_primary_folder_version = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -792,6 +846,9 @@ static void parse_pull_vcard_listing_app_param(esp_pbac_param_t *param, uint8_t
ptr += BTA_PBAP_APP_PARAM_LENGTH_PRIMARY_FOLDER_VERSION;
break;
case BTA_PBAP_APP_PARAM_SECONDARY_FOLDER_VERSION:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_SECONDARY_FOLDER_VERSION)) {
goto error;
}
param->pull_vcard_listing_rsp.include_secondary_folder_version = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -799,6 +856,9 @@ static void parse_pull_vcard_listing_app_param(esp_pbac_param_t *param, uint8_t
ptr += BTA_PBAP_APP_PARAM_LENGTH_SECONDARY_FOLDER_VERSION;
break;
case BTA_PBAP_APP_PARAM_DATABASE_IDENTIFIER:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_DATABASE_IDENTIFIER)) {
goto error;
}
param->pull_vcard_listing_rsp.include_database_identifier = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -810,8 +870,19 @@ static void parse_pull_vcard_listing_app_param(esp_pbac_param_t *param, uint8_t
break;
}
}
error:
return;
error:
param->pull_vcard_listing_rsp.include_phone_book_size = 0;
param->pull_vcard_listing_rsp.phone_book_size = 0;
param->pull_vcard_listing_rsp.include_new_missed_calls = 0;
param->pull_vcard_listing_rsp.new_missed_calls = 0;
param->pull_vcard_listing_rsp.include_primary_folder_version = 0;
param->pull_vcard_listing_rsp.primary_folder_version = NULL;
param->pull_vcard_listing_rsp.include_secondary_folder_version = 0;
param->pull_vcard_listing_rsp.secondary_folder_version = NULL;
param->pull_vcard_listing_rsp.include_database_identifier = 0;
param->pull_vcard_listing_rsp.database_identifier = NULL;
}
static void parse_pull_vcard_entry_app_param(esp_pbac_param_t *param, uint8_t *app_param, uint16_t app_param_len)
@@ -819,11 +890,17 @@ static void parse_pull_vcard_entry_app_param(esp_pbac_param_t *param, uint8_t *a
if (app_param == NULL || app_param_len == 0) {
return;
}
uint8_t *ptr = app_param;
while(ptr < app_param + app_param_len) {
const uint8_t *end = app_param + app_param_len;
while (ptr < end) {
switch (*ptr)
{
case BTA_PBAP_APP_PARAM_DATABASE_IDENTIFIER:
if (!btc_pba_client_app_param_tag_valid(ptr, end, BTA_PBAP_APP_PARAM_LENGTH_DATABASE_IDENTIFIER)) {
goto error;
}
param->pull_vcard_entry_rsp.include_database_identifier = 1;
ptr += BTA_PBAP_APP_PARAM_HEADER_LENGTH;
/* don't copy */
@@ -835,8 +912,11 @@ static void parse_pull_vcard_entry_app_param(esp_pbac_param_t *param, uint8_t *a
break;
}
}
error:
return;
error:
param->pull_vcard_entry_rsp.include_database_identifier = 0;
param->pull_vcard_entry_rsp.database_identifier = NULL;
}
static uint16_t get_next_dir_len_from_path(char *path, uint16_t path_len, uint16_t path_pos)

17
components/bt/host/bluedroid/stack/btm/btm_sec.c
View File

@@ -4490,7 +4490,7 @@ void btm_sec_connected (UINT8 *bda, UINT16 handle, UINT8 status, UINT8 enc_mode)
(status == HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE) ||
(status == HCI_ERR_REPEATED_ATTEMPTS)))) {
p_dev_rec->security_required &= ~BTM_SEC_OUT_AUTHENTICATE;
p_dev_rec->sec_flags &= ~ (BTM_SEC_LE_LINK_KEY_KNOWN << bit_shift);
p_dev_rec->sec_flags &= ~((BTM_SEC_LINK_KEY_KNOWN | BTM_SEC_LINK_KEY_AUTHED) << bit_shift);
#ifdef BRCM_NOT_4_BTE
@@ -5453,9 +5453,11 @@ static BOOLEAN btm_sec_start_get_name (tBTM_SEC_DEV_REC *p_dev_rec)
*******************************************************************************/
static BOOLEAN btm_sec_start_authentication (tBTM_SEC_DEV_REC *p_dev_rec)
{
p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
return (btsnd_hcic_auth_request (p_dev_rec->hci_handle));
if (btsnd_hcic_auth_request (p_dev_rec->hci_handle)) {
p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
return TRUE;
}
return FALSE;
}
/*******************************************************************************
@@ -6394,9 +6396,10 @@ void btm_sec_update_legacy_auth_state(tACL_CONN *p_acl_cb, UINT8 legacy_auth_sta
*******************************************************************************/
void btm_sec_handle_remote_legacy_auth_cmp(UINT16 handle)
{
tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev_by_handle (handle);
tACL_CONN *p_acl_cb = btm_bda_to_acl(p_dev_rec->bd_addr, BT_TRANSPORT_BR_EDR);
btm_sec_update_legacy_auth_state(p_acl_cb, BTM_ACL_LEGACY_AUTH_REMOTE);
tACL_CONN *p_acl_cb = btm_handle_to_acl(handle);
if (p_acl_cb) {
btm_sec_update_legacy_auth_state(p_acl_cb, BTM_ACL_LEGACY_AUTH_REMOTE);
}
}
#endif /// (CLASSIC_BT_INCLUDED == TRUE)
#endif ///SMP_INCLUDED == TRUE

46
components/esp_hid/src/esp_hid_common.c
View File

@@ -1,9 +1,11 @@
/*
* SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <stdint.h>
#include <inttypes.h>
#include <string.h>
#include <stdbool.h>
#include "esp_log.h"
@@ -65,6 +67,19 @@ static int add_report(temp_hid_report_map_t *map, esp_hid_report_item_t *item)
return 0;
}
static int add_report_len_bits_to(uint16_t *len_bits, uint16_t size, uint16_t count)
{
uint32_t add = (uint32_t)size * (uint32_t)count;
uint32_t new_len = (uint32_t)(*len_bits) + add;
if (new_len > UINT16_MAX) {
ESP_LOGE(TAG, "report length overflow: %u + %u * %u", *len_bits, size, count);
return -1;
}
*len_bits = (uint16_t)new_len;
return 0;
}
static int handle_report(hid_report_params_t *report, bool first)
{
if (s_temp_hid_report_map == NULL) {
@@ -290,15 +305,34 @@ static int handle_cmd(hid_report_cmd_t *cmd)
} else if (cmd->cmd == HID_RM_USAGE) {
s_report_params.inner_usage = cmd->value;
} else if (cmd->cmd == HID_RM_REPORT_SIZE) {
s_report_size = cmd->value;
if (cmd->value > UINT16_MAX) {
ESP_LOGE(TAG, "REPORT_SIZE too large: %" PRIu32, cmd->value);
s_parse_step = PARSE_WAIT_USAGE_PAGE;
return -1;
}
s_report_size = (uint16_t)cmd->value;
} else if (cmd->cmd == HID_RM_REPORT_COUNT) {
s_report_count = cmd->value;
if (cmd->value > UINT16_MAX) {
ESP_LOGE(TAG, "REPORT_COUNT too large: %" PRIu32, cmd->value);
s_parse_step = PARSE_WAIT_USAGE_PAGE;
return -1;
}
s_report_count = (uint16_t)cmd->value;
} else if (cmd->cmd == HID_RM_INPUT) {
s_report_params.input_len += (s_report_size * s_report_count);
if (add_report_len_bits_to(&s_report_params.input_len, s_report_size, s_report_count) != 0) {
s_parse_step = PARSE_WAIT_USAGE_PAGE;
return -1;
}
} else if (cmd->cmd == HID_RM_OUTPUT) {
s_report_params.output_len += (s_report_size * s_report_count);
if (add_report_len_bits_to(&s_report_params.output_len, s_report_size, s_report_count) != 0) {
s_parse_step = PARSE_WAIT_USAGE_PAGE;
return -1;
}
} else if (cmd->cmd == HID_RM_FEATURE) {
s_report_params.feature_len += (s_report_size * s_report_count);
if (add_report_len_bits_to(&s_report_params.feature_len, s_report_size, s_report_count) != 0) {
s_parse_step = PARSE_WAIT_USAGE_PAGE;
return -1;
}
} else if (cmd->cmd == HID_RM_COLLECTION) {
s_collection_depth += 1;
} else if (cmd->cmd == HID_RM_END_COLLECTION) {