fix(ble/bluedroid): fix GAP BLE API parameter validation

(cherry picked from commit e3311c81c4)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -15,6 +15,9 @@
 #include "btc/btc_ble_storage.h"
 #include "esp_random.h"
 
+/* Hard upper bound to prevent excessive allocations in BTC/BTA layers. */
+#define ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN 1650U
+
 esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -158,7 +161,22 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
         ESP_BLE_IS_VALID_PARAM(params->max_int, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(params->timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
         (params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
-        ((params->timeout * 10) >= ((1 + params->latency) * ((params->max_int * 5) >> 1))) && params->min_int <= params->max_int) {
+        /*
+         * Core Spec (Vol 6, Part B, Section 4.5.2):
+         * supervision_timeout shall be strictly greater than
+         * (1 + connSlaveLatency) * connIntervalMax * 2.
+         *
+         * Here:
+         * - timeout is in 10 ms units
+         * - max_int is in 1.25 ms units
+         *
+         * Convert both sides into 0.5 ms units to avoid truncation:
+         * (timeout * 10 ms) -> timeout * 20 (0.5 ms units)
+         * (max_int * 1.25 ms * 2) -> max_int * 5 (0.5 ms units)
+         */
+        (((uint32_t)params->timeout * 20U) >
+         ((uint32_t)(1U + (uint32_t)params->latency) * (uint32_t)params->max_int * 5U)) &&
+        (params->min_int <= params->max_int)) {
 
         msg.sig = BTC_SIG_API_CALL;
         msg.pid = BTC_PID_GAP_BLE;
@@ -339,7 +357,7 @@ esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda
         return ESP_ERR_INVALID_STATE;
     }
     if (!remote_bda){
-        return ESP_ERR_INVALID_SIZE;
+        return ESP_ERR_INVALID_ARG;
     }
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GAP_BLE;
@@ -369,7 +387,7 @@ esp_err_t esp_ble_gap_clear_whitelist(void)
 esp_err_t esp_ble_gap_get_whitelist_size(uint16_t *length)
 {
     if (length == NULL) {
-        return ESP_FAIL;
+        return ESP_ERR_INVALID_ARG;
     }
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
     btc_get_whitelist_size(length);
@@ -397,7 +415,9 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
         ESP_BLE_IS_VALID_PARAM(max_conn_int, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
         (slave_latency <= ESP_BLE_CONN_LATENCY_MAX) &&
-        ((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) {
+        (((uint32_t)supervision_tout * 20U) >
+         ((uint32_t)(1U + (uint32_t)slave_latency) * (uint32_t)max_conn_int * 5U)) &&
+        (min_conn_int <= max_conn_int)) {
 
         msg.sig = BTC_SIG_API_CALL;
         msg.pid = BTC_PID_GAP_BLE;
@@ -678,7 +698,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
         uint32_t passkey = 0;
         for(uint8_t i = 0; i < len; i++)
         {
-            passkey += (((uint8_t *)value)[i]<<(8*i));
+            passkey += ((uint32_t)((const uint8_t *)value)[i] << (8U * (uint32_t)i));
         }
         if(passkey > 999999) {
             return ESP_ERR_INVALID_ARG;
@@ -846,6 +866,15 @@ esp_err_t esp_ble_get_bond_device_list(int *dev_num, esp_ble_bond_dev_t *dev_lis
         *dev_num = dev_num_total;
     }
 
+    /*
+     * The storage layer updates some fields using |= (e.g. key_mask). Ensure
+     * the caller-provided list is zero-initialized to avoid propagating
+     * uninitialized heap contents (including padding) back to the caller.
+     */
+    if (*dev_num > 0) {
+        memset(dev_list, 0, sizeof(*dev_list) * (size_t)(*dev_num));
+    }
+
     ret = btc_storage_get_bonded_ble_devices_list(dev_list, *dev_num);
 
     return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -1293,6 +1322,10 @@ esp_err_t esp_ble_gap_config_ext_adv_data_raw(uint8_t instance, uint16_t length,
          return ESP_ERR_INVALID_ARG;
     }
 
+    if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
 
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GAP_BLE;
@@ -1319,6 +1352,10 @@ esp_err_t esp_ble_gap_config_ext_scan_rsp_data_raw(uint8_t instance, uint16_t le
         return ESP_ERR_INVALID_ARG;
     }
 
+    if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW;
@@ -1454,6 +1491,10 @@ esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t le
         return ESP_ERR_INVALID_ARG;
     }
 
+    if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
 
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GAP_BLE;
@@ -1751,7 +1792,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
             ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
             (phy_1m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
-            ((phy_1m_conn_params->supervision_timeout * 10) >= ((1 + phy_1m_conn_params->latency) * ((phy_1m_conn_params->interval_max * 5) >> 1))) &&
+            (((uint32_t)phy_1m_conn_params->supervision_timeout * 20U) >
+             ((uint32_t)(1U + (uint32_t)phy_1m_conn_params->latency) * (uint32_t)phy_1m_conn_params->interval_max * 5U)) &&
             (phy_1m_conn_params->interval_min <= phy_1m_conn_params->interval_max)) {
 
             memcpy(&arg.set_ext_conn_params.phy_1m_conn_params, phy_1m_conn_params, sizeof(esp_ble_gap_conn_params_t));
@@ -1775,7 +1817,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
             ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
             (phy_2m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
-            ((phy_2m_conn_params->supervision_timeout * 10) >= ((1 + phy_2m_conn_params->latency) * ((phy_2m_conn_params->interval_max * 5) >> 1))) &&
+            (((uint32_t)phy_2m_conn_params->supervision_timeout * 20U) >
+             ((uint32_t)(1U + (uint32_t)phy_2m_conn_params->latency) * (uint32_t)phy_2m_conn_params->interval_max * 5U)) &&
             (phy_2m_conn_params->interval_min <= phy_2m_conn_params->interval_max)) {
 
             memcpy(&arg.set_ext_conn_params.phy_2m_conn_params, phy_2m_conn_params, sizeof(esp_ble_gap_conn_params_t));
@@ -1799,7 +1842,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
             ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
             (phy_coded_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
-            ((phy_coded_conn_params->supervision_timeout * 10) >= ((1 + phy_coded_conn_params->latency) * ((phy_coded_conn_params->interval_max * 5) >> 1))) &&
+            (((uint32_t)phy_coded_conn_params->supervision_timeout * 20U) >
+             ((uint32_t)(1U + (uint32_t)phy_coded_conn_params->latency) * (uint32_t)phy_coded_conn_params->interval_max * 5U)) &&
             (phy_coded_conn_params->interval_min <= phy_coded_conn_params->interval_max)) {
 
             memcpy(&arg.set_ext_conn_params.phy_coded_conn_params, phy_coded_conn_params, sizeof(esp_ble_gap_conn_params_t));

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -2532,7 +2532,6 @@ typedef union {
      */
     struct ble_cs_read_local_supp_caps_evt {
         esp_bt_status_t status;                  /*!< Indicate channel sounding read local supported capabilities command successfully completed */
-        uint16_t conn_handle;                    /*!< Connection Handle */
         uint8_t num_config_supported;            /*!< Number of CS configurations supported per connection */
         uint16_t max_consecutive_proc_supported; /*!< 0x0000: Support for both a fixed number of consecutive CS procedures and for an indefinite number of CS procedures until termination
                                                     0x0001 to 0xFFFF: Maximum number of consecutive CS procedures supported */
@@ -3113,6 +3112,11 @@ esp_err_t esp_ble_gap_add_device_to_resolving_list(esp_bd_addr_t peer_addr, uint
 /**
  * @brief           This function clears the random address for the application
  *
+ * @note            This function shall not be used when:
+ *                  - Advertising is enabled,
+ *                  - Scanning is enabled, or
+ *                  - any LE connection exists / a create connection command is pending.
+ *
  * @return
  *                  - ESP_OK : success
  *                  - other  : failed

components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -490,7 +490,8 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params)
     tBLE_BD_ADDR peer_addr;
     esp_bt_status_t status = ESP_BT_STATUS_SUCCESS;
     if (!BLE_ISVALID_PARAM(ble_adv_params->adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
-            !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+            !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
+        ble_adv_params->adv_int_min > ble_adv_params->adv_int_max) {
         status = ESP_BT_STATUS_PARM_INVALID;
         BTC_TRACE_ERROR("Invalid advertisting interval parameters.\n");
     }
@@ -563,7 +564,8 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params)
         BLE_ISVALID_PARAM(scan_params->own_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RPA_RANDOM) &&
         BLE_ISVALID_PARAM(scan_params->scan_filter_policy, BLE_SCAN_FILTER_ALLOW_ALL, BLE_SCAN_FILTER_ALLOW_WLIST_RPA_DIR) &&
         BLE_ISVALID_PARAM(scan_params->scan_duplicate, BLE_SCAN_DUPLICATE_DISABLE, BLE_SCAN_DUPLICATE_MAX -1) &&
-        (scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS)) {
+        (scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS) &&
+        scan_params->scan_window <= scan_params->scan_interval) {
         BTA_DmSetBleScanFilterParams(ESP_DEFAULT_GATT_IF,	/*client_if*/
                                      scan_params->scan_interval,
                                      scan_params->scan_window,
@@ -936,7 +938,7 @@ static void btc_read_ble_rssi_cmpl_callback(void *p_data)
 static void btc_ble_read_channel_map_callback(void *p_data)
 {
     tBTA_BLE_CH_MAP_RESULTS *result = (tBTA_BLE_CH_MAP_RESULTS *)p_data;
-    esp_ble_gap_cb_param_t param;
+    esp_ble_gap_cb_param_t param = {0};
     bt_status_t ret;
     btc_msg_t msg = {0};
 
@@ -1229,7 +1231,14 @@ void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
 #if (BLE_50_EXTEND_SCAN_EN == TRUE)
         case BTA_DM_BLE_5_GAP_EXT_ADV_REPORT_EVT:
             msg.act = ESP_GAP_BLE_EXT_ADV_REPORT_EVT;
-            memcpy(&param.ext_adv_report.params, &params->ext_adv_report, sizeof(esp_ble_gap_ext_adv_report_t));
+            memcpy(&param.ext_adv_report.params, &params->ext_adv_report, sizeof(tBTM_BLE_EXT_ADV_REPORT));
+            /* The source struct ends with a pointer (UINT8 *adv_data) while the destination
+             * ends with a fixed array (uint8_t adv_data[251]). The memcpy above leaves the
+             * raw pointer bytes at the start of adv_data[]. Clear it before copying the real
+             * advertising payload to avoid leaking stale pointer bytes when adv_data is NULL
+             * or adv_data_len is smaller than sizeof(void *). */
+            memset(param.ext_adv_report.params.adv_data, 0,
+                   sizeof(param.ext_adv_report.params.adv_data));
             if (params->ext_adv_report.adv_data) {
                 memcpy(param.ext_adv_report.params.adv_data,
                     params->ext_adv_report.adv_data, params->ext_adv_report.adv_data_len);
@@ -1483,7 +1492,6 @@ void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
         case BTA_BLE_GAP_CS_READ_LOCAL_SUPP_CAPS_EVT:
             msg.act = ESP_GAP_BLE_CS_READ_LOCAL_SUPP_CAPS_EVT;
             param.cs_read_local_supp_caps.status = btc_btm_status_to_esp_status(params->cs_read_local_supp_caps.status);
-            param.cs_read_local_supp_caps.conn_handle = params->cs_read_local_supp_caps.conn_handle;
             param.cs_read_local_supp_caps.num_config_supported = params->cs_read_local_supp_caps.num_config_supported;
             param.cs_read_local_supp_caps.max_consecutive_proc_supported = params->cs_read_local_supp_caps.max_consecutive_proc_supported;
             param.cs_read_local_supp_caps.num_ant_supported = params->cs_read_local_supp_caps.num_ant_supported;
@@ -1648,12 +1656,12 @@ void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
-void btc_dtm_tx_start_callback(void *p1)
+void btc_dtm_tx_start_callback(UINT8 *p1, UINT16 len)
 {
     UINT8 status;
     UINT8 *p;
     p = (UINT8*) p1;
-    if (p1) {
+    if (p1 && len >= 1) {
         STREAM_TO_UINT8(status, p);
         BTC_TRACE_DEBUG("DTM TX start, status 0x%x\n", status);
         esp_ble_gap_cb_param_t param;
@@ -1675,13 +1683,13 @@ void btc_dtm_tx_start_callback(void *p1)
     }
 }
 
-void btc_dtm_rx_start_callback(void *p1)
+void btc_dtm_rx_start_callback(UINT8 *p1, UINT16 len)
 {
 
     UINT8 status;
     UINT8 *p;
     p = (UINT8*) p1;
-    if (p1) {
+    if (p1 && len >= 1) {
         STREAM_TO_UINT8(status, p);
         BTC_TRACE_DEBUG("DTM RX start, status 0x%x\n", status);
         esp_ble_gap_cb_param_t param;
@@ -1705,13 +1713,13 @@ void btc_dtm_rx_start_callback(void *p1)
 #endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
 
 #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
-void btc_dtm_stop_callback(void *p1)
+void btc_dtm_stop_callback(UINT8 *p1, UINT16 len)
 {
     UINT8 status;
     UINT16 num_pkt;
     UINT8 *p;
     p = (UINT8*) p1;
-    if (p1) {
+    if (p1 && len >= 3) {
         STREAM_TO_UINT8(status, p);
         STREAM_TO_UINT16(num_pkt, p);
         BTC_TRACE_DEBUG("DTM stop, status 0x%x num_pkt %d\n", status, num_pkt);
@@ -1876,6 +1884,13 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
     btc_msg_t msg = {0};
     esp_ble_vendor_evt_param_t *evt_param = &param.vendor_hci_evt.param;
     bool copy_param = false;
+    bool parse_ok = true;
+
+    if (param_len && params == NULL) {
+        BTC_TRACE_WARNING("%s vendor evt NULL: sub=0x%02x len=%u",
+                          __func__, subevt_code, param_len);
+        return;
+    }
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -1887,6 +1902,12 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
     switch (subevt_code) {
     case BLE_VENDOR_PDU_RECV_EVT:
         param.vendor_hci_evt.subevt_code = ESP_BLE_VENDOR_PDU_RECV_EVT;
+        if (param_len < (UINT8)(1 + 1 + 1 + BD_ADDR_LEN)) {
+            BTC_TRACE_WARNING("%s vendor trunc: sub=0x%02x len=%u<%u",
+                              __func__, subevt_code, param_len, (unsigned)(1 + 1 + 1 + BD_ADDR_LEN));
+            parse_ok = false;
+            break;
+        }
         STREAM_TO_UINT8(evt_param->pdu_recv.type, params);
         STREAM_TO_UINT8(evt_param->pdu_recv.handle, params);
         STREAM_TO_UINT8(evt_param->pdu_recv.addr_type, params);
@@ -1894,6 +1915,12 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
         break;
     case BLE_VENDOR_CHMAP_UPDATE_EVT:
         param.vendor_hci_evt.subevt_code = ESP_BLE_VENDOR_CHAN_MAP_UPDATE_EVT;
+        if (param_len < (UINT8)(1 + 2 + ESP_GAP_BLE_CHANNELS_LEN)) {
+            BTC_TRACE_WARNING("%s vendor trunc: sub=0x%02x len=%u<%u",
+                              __func__, subevt_code, param_len, (unsigned)(1 + 2 + ESP_GAP_BLE_CHANNELS_LEN));
+            parse_ok = false;
+            break;
+        }
         STREAM_TO_UINT8(evt_param->chan_map_update.status, params);
         STREAM_TO_UINT16(evt_param->chan_map_update.conn_handle, params);
         REVERSE_STREAM_TO_ARRAY(evt_param->chan_map_update.ch_map, params, ESP_GAP_BLE_CHANNELS_LEN);
@@ -1907,6 +1934,17 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
         break;
     }
 
+    if (!parse_ok) {
+        /* Malformed/truncated parameters: keep the mapped esp_ble_vendor_evt_t
+         * already assigned in the switch (do NOT restore the raw HCI subevent
+         * code, which is outside esp_ble_vendor_evt_t and would break the
+         * public API contract). Zero the structured fields and suppress the
+         * internal raw buffer so the callback delivers a deterministic event;
+         * the truncation has already been logged above. */
+        memset(evt_param, 0, sizeof(*evt_param));
+        copy_param = false;
+    }
+
     if (copy_param) {
         param.vendor_hci_evt.param_len = param_len;
         param.vendor_hci_evt.param_buf = (param_len) ? params : NULL;
@@ -2140,20 +2178,38 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t  *dst = (btc_ble_gap_args_t *) p_dest;
 
-        if (src->cfg_adv_data.adv_data.p_manufacturer_data) {
+        /* btc_transfer_context() does a shallow memcpy first; always null-out
+         * pointer fields so deep_free() never frees non-owned memory on OOM. */
+        dst->cfg_adv_data.adv_data.p_manufacturer_data = NULL;
+        dst->cfg_adv_data.adv_data.p_service_data = NULL;
+        dst->cfg_adv_data.adv_data.p_service_uuid = NULL;
+
+        if (src->cfg_adv_data.adv_data.p_manufacturer_data && src->cfg_adv_data.adv_data.manufacturer_len) {
             dst->cfg_adv_data.adv_data.p_manufacturer_data = osi_malloc(src->cfg_adv_data.adv_data.manufacturer_len);
-            memcpy(dst->cfg_adv_data.adv_data.p_manufacturer_data, src->cfg_adv_data.adv_data.p_manufacturer_data,
+            if (dst->cfg_adv_data.adv_data.p_manufacturer_data) {
-                   src->cfg_adv_data.adv_data.manufacturer_len);
+                memcpy(dst->cfg_adv_data.adv_data.p_manufacturer_data, src->cfg_adv_data.adv_data.p_manufacturer_data,
+                        src->cfg_adv_data.adv_data.manufacturer_len);
+            } else {
+                BTC_TRACE_WARNING("%s no mem, manu drop %u", __func__, src->cfg_adv_data.adv_data.manufacturer_len);
+            }
         }
 
-        if (src->cfg_adv_data.adv_data.p_service_data) {
+        if (src->cfg_adv_data.adv_data.p_service_data && src->cfg_adv_data.adv_data.service_data_len) {
             dst->cfg_adv_data.adv_data.p_service_data = osi_malloc(src->cfg_adv_data.adv_data.service_data_len);
-            memcpy(dst->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.service_data_len);
+            if (dst->cfg_adv_data.adv_data.p_service_data) {
+                memcpy(dst->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.service_data_len);
+            } else {
+                BTC_TRACE_WARNING("%s no mem, svc_data drop %u", __func__, src->cfg_adv_data.adv_data.service_data_len);
+            }
         }
 
-        if (src->cfg_adv_data.adv_data.p_service_uuid) {
+        if (src->cfg_adv_data.adv_data.p_service_uuid && src->cfg_adv_data.adv_data.service_uuid_len) {
             dst->cfg_adv_data.adv_data.p_service_uuid = osi_malloc(src->cfg_adv_data.adv_data.service_uuid_len);
-            memcpy(dst->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.service_uuid_len);
+            if (dst->cfg_adv_data.adv_data.p_service_uuid) {
+                memcpy(dst->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.service_uuid_len);
+            } else {
+                BTC_TRACE_WARNING("%s no mem, svc_uuid drop %u", __func__, src->cfg_adv_data.adv_data.service_uuid_len);
+            }
         }
         break;
     }
@@ -2161,10 +2217,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
 
+        dst->cfg_adv_data_raw.raw_adv = NULL;
+        dst->cfg_adv_data_raw.raw_adv_len = 0;
         if (src && src->cfg_adv_data_raw.raw_adv && src->cfg_adv_data_raw.raw_adv_len > 0) {
             dst->cfg_adv_data_raw.raw_adv = osi_malloc(src->cfg_adv_data_raw.raw_adv_len);
             if (dst->cfg_adv_data_raw.raw_adv) {
                 memcpy(dst->cfg_adv_data_raw.raw_adv, src->cfg_adv_data_raw.raw_adv, src->cfg_adv_data_raw.raw_adv_len);
+                dst->cfg_adv_data_raw.raw_adv_len = src->cfg_adv_data_raw.raw_adv_len;
             }
         }
         break;
@@ -2173,10 +2232,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
 
+        dst->cfg_scan_rsp_data_raw.raw_scan_rsp = NULL;
+        dst->cfg_scan_rsp_data_raw.raw_scan_rsp_len = 0;
         if (src && src->cfg_scan_rsp_data_raw.raw_scan_rsp && src->cfg_scan_rsp_data_raw.raw_scan_rsp_len > 0) {
             dst->cfg_scan_rsp_data_raw.raw_scan_rsp = osi_malloc(src->cfg_scan_rsp_data_raw.raw_scan_rsp_len);
             if (dst->cfg_scan_rsp_data_raw.raw_scan_rsp) {
                 memcpy(dst->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp_len);
+                dst->cfg_scan_rsp_data_raw.raw_scan_rsp_len = src->cfg_scan_rsp_data_raw.raw_scan_rsp_len;
             }
         }
           break;
@@ -2187,6 +2249,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t  *dst = (btc_ble_gap_args_t *) p_dest;
         uint8_t length = 0;
+        dst->set_security_param.value = NULL;
         if (src->set_security_param.value) {
             length = dst->set_security_param.len;
             dst->set_security_param.value = osi_malloc(length);
@@ -2194,6 +2257,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
                 memcpy(dst->set_security_param.value, src->set_security_param.value, length);
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+                dst->set_security_param.len = 0;
             }
         }
         break;
@@ -2202,6 +2266,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t  *dst = (btc_ble_gap_args_t *) p_dest;
         uint8_t length = 0;
+        dst->oob_req_reply.p_value = NULL;
         if (src->oob_req_reply.p_value) {
             length = dst->oob_req_reply.len;
             dst->oob_req_reply.p_value = osi_malloc(length);
@@ -2209,6 +2274,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
                 memcpy(dst->oob_req_reply.p_value, src->oob_req_reply.p_value, length);
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+                dst->oob_req_reply.len = 0;
             }
         }
         break;
@@ -2216,6 +2282,8 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     case BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT: {
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest;
+        dst->sc_oob_req_reply.p_c = NULL;
+        dst->sc_oob_req_reply.p_r = NULL;
         if (src->sc_oob_req_reply.p_c) {
             dst->sc_oob_req_reply.p_c = osi_malloc(BT_OCTET16_LEN);
             if (dst->sc_oob_req_reply.p_c) {
@@ -2236,17 +2304,38 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     }
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_50_EXTEND_ADV_EN == TRUE)
-    case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW:
+    case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: {
-    case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
         btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src;
         btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest;
         uint16_t length = 0;
 
+        dst->ext_adv_cfg_data.data = NULL;
+        dst->ext_adv_cfg_data.length = 0;
         if (src->ext_adv_cfg_data.data) {
             length = src->ext_adv_cfg_data.length;
             dst->ext_adv_cfg_data.data = osi_malloc(length);
             if (dst->ext_adv_cfg_data.data) {
                 memcpy(dst->ext_adv_cfg_data.data, src->ext_adv_cfg_data.data, length);
+                dst->ext_adv_cfg_data.length = length;
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
+        }
+        break;
+    }
+    case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
+        btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src;
+        btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest;
+        uint16_t length = 0;
+
+        dst->cfg_scan_rsp.data = NULL;
+        dst->cfg_scan_rsp.length = 0;
+        if (src->cfg_scan_rsp.data) {
+            length = src->cfg_scan_rsp.length;
+            dst->cfg_scan_rsp.data = osi_malloc(length);
+            if (dst->cfg_scan_rsp.data) {
+                memcpy(dst->cfg_scan_rsp.data, src->cfg_scan_rsp.data, length);
+                dst->cfg_scan_rsp.length = length;
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
             }
@@ -2260,17 +2349,17 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest;
         uint16_t length = 0;
 
+        dst->periodic_adv_cfg_data.data = NULL;
+        dst->periodic_adv_cfg_data.len = 0;
         if (src->periodic_adv_cfg_data.data) {
             length = src->periodic_adv_cfg_data.len;
             dst->periodic_adv_cfg_data.data = osi_malloc(length);
             if (dst->periodic_adv_cfg_data.data) {
                 memcpy(dst->periodic_adv_cfg_data.data, src->periodic_adv_cfg_data.data, length);
+                dst->periodic_adv_cfg_data.len = length;
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
             }
-        } else {
-            dst->periodic_adv_cfg_data.data = NULL;
-            dst->periodic_adv_cfg_data.len = 0;
         }
         break;
     }
@@ -2308,10 +2397,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT: {
         btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
         btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest;
+        dst->vendor_cmd_send.p_param_buf = NULL;
+        dst->vendor_cmd_send.param_len = 0;
         if (src->vendor_cmd_send.param_len) {
             dst->vendor_cmd_send.p_param_buf = osi_malloc(src->vendor_cmd_send.param_len);
             if (dst->vendor_cmd_send.p_param_buf) {
                 memcpy(dst->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.param_len);
+                dst->vendor_cmd_send.param_len = src->vendor_cmd_send.param_len;
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
             }
@@ -2398,11 +2490,14 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 
     switch (msg->act) {
     case ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT: {
+        dst->vendor_cmd_cmpl.p_param_buf = NULL;
+        dst->vendor_cmd_cmpl.param_len = 0;
         if (src->vendor_cmd_cmpl.param_len) {
             dst->vendor_cmd_cmpl.p_param_buf = osi_malloc(src->vendor_cmd_cmpl.param_len);
             if (dst->vendor_cmd_cmpl.p_param_buf) {
                 memcpy(dst->vendor_cmd_cmpl.p_param_buf, src->vendor_cmd_cmpl.p_param_buf,
                    src->vendor_cmd_cmpl.param_len);
+                dst->vendor_cmd_cmpl.param_len = src->vendor_cmd_cmpl.param_len;
             } else {
                 BTC_TRACE_ERROR("%s, malloc failed\n", __func__);
             }
@@ -2410,11 +2505,14 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         break;
     }
     case ESP_GAP_BLE_VENDOR_HCI_EVT: {
+        dst->vendor_hci_evt.param_buf = NULL;
+        dst->vendor_hci_evt.param_len = 0;
         if (src->vendor_hci_evt.param_len) {
             dst->vendor_hci_evt.param_buf = osi_malloc(src->vendor_hci_evt.param_len);
             if (dst->vendor_hci_evt.param_buf) {
                 memcpy(dst->vendor_hci_evt.param_buf, src->vendor_hci_evt.param_buf,
                     src->vendor_hci_evt.param_len);
+                dst->vendor_hci_evt.param_len = src->vendor_hci_evt.param_len;
             } else {
                 BTC_TRACE_ERROR("%s, malloc failed\n", __func__);
             }
@@ -2476,7 +2574,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
                     }
                 }
             } else {
-                BTC_TRACE_ERROR("%s, pa_rsp_info, no enough memory.", __func__);
+                BTC_TRACE_ERROR("%s, step_info, no enough memory.", __func__);
             }
         }
         break;
@@ -2499,7 +2597,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
                     }
                 }
             } else {
-                BTC_TRACE_ERROR("%s, pa_rsp_info, no enough memory.", __func__);
+                BTC_TRACE_ERROR("%s, continue step_info, no enough memory.", __func__);
             }
         }
         break;
@@ -2574,14 +2672,20 @@ void btc_gap_ble_arg_deep_free(btc_msg_t *msg)
     }
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_50_EXTEND_ADV_EN == TRUE)
-    case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW:
+    case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: {
-    case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
         uint8_t *value = ((btc_ble_5_gap_args_t *)msg->arg)->ext_adv_cfg_data.data;
         if (value) {
             osi_free(value);
         }
 	break;
     }
+    case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
+        uint8_t *value = ((btc_ble_5_gap_args_t *)msg->arg)->cfg_scan_rsp.data;
+        if (value) {
+            osi_free(value);
+        }
+	break;
+    }
 #endif // #if (BLE_50_EXTEND_ADV_EN == TRUE)
 #if (BLE_50_PERIODIC_ADV_EN == TRUE)
     case BTC_GAP_BLE_CFG_PERIODIC_ADV_DATA_RAW: {
@@ -3033,9 +3137,9 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
         break;
     case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW:
         BTC_TRACE_DEBUG("BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW");
-        BTA_DmBleGapConfigExtAdvDataRaw(TRUE, arg_5->ext_adv_cfg_data.instance,
+        BTA_DmBleGapConfigExtAdvDataRaw(TRUE, arg_5->cfg_scan_rsp.instance,
-                                       arg_5->ext_adv_cfg_data.length,
+                                       arg_5->cfg_scan_rsp.length,
-                                       (const UINT8 *)arg_5->ext_adv_cfg_data.data);
+                                       (const UINT8 *)arg_5->cfg_scan_rsp.data);
         break;
     case BTC_GAP_BLE_EXT_ADV_START: {
         BTC_TRACE_DEBUG("BTC_GAP_BLE_EXT_ADV_START");

components/bt/host/bluedroid/stack/btm/btm_acl.c

@@ -2279,7 +2279,7 @@ void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types)
 tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda)
 {
     tACL_CONN *p;
-    tBTM_BLE_CH_MAP_RESULTS result;
+    tBTM_BLE_CH_MAP_RESULTS result = {0};
     tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params;
     UINT8 status;
 
@@ -2322,7 +2322,7 @@ void BTM_BleGetWhiteListSize(uint16_t *length)
 {
     tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
     if (p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_WARNING("%s Whitelist full.", __func__);
+        BTM_TRACE_WARNING("%s Whitelist size is 0.", __func__);
     }
     *length = p_cb->white_list_avail_size;
     return;
@@ -2356,7 +2356,7 @@ void BTM_BleGetPeriodicAdvListSize(uint8_t *size)
 *******************************************************************************/
 void btm_read_channel_map_complete(UINT8 *p)
 {
-    tBTM_BLE_CH_MAP_RESULTS results;
+    tBTM_BLE_CH_MAP_RESULTS results = {0};
     UINT16 handle;
     tACL_CONN *p_acl_cb = NULL;
 

components/bt/host/bluedroid/stack/btm/btm_ble.c

@@ -736,7 +736,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT tran
 **               p_cmd_cmpl_cback - Command Complete callback
 **
 *******************************************************************************/
-void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback)
+void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
 {
     btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
 
@@ -758,7 +758,7 @@ void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback)
 **
 *******************************************************************************/
 void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
-                            UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback)
+                            UINT8 packet_payload, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
 {
     btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
     if (btsnd_hcic_ble_transmitter_test(tx_freq, test_data_len, packet_payload) == FALSE) {
@@ -776,7 +776,7 @@ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
 ** Parameter       p_cmd_cmpl_cback - Command complete callback
 **
 *******************************************************************************/
-void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback)
+void BTM_BleTestEnd(tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
 {
     btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
 
@@ -788,14 +788,14 @@ void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback)
 /*******************************************************************************
 ** Internal Functions
 *******************************************************************************/
-void btm_ble_test_command_complete(UINT8 *p)
+void btm_ble_test_command_complete(UINT8 *p, UINT16 len)
 {
-    tBTM_CMPL_CB   *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb;
+    tBTM_DTM_CMD_CMPL_CBACK *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb;
 
     btm_cb.devcb.p_le_test_cmd_cmpl_cb = NULL;
 
     if (p_cb) {
-        (*p_cb)(p);
+        (*p_cb)(p, len);
     }
 }
 #endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
@@ -813,7 +813,7 @@ void btm_ble_test_command_complete(UINT8 *p)
 **                 p_cmd_cmpl_cback - Command Complete callback
 **
 *******************************************************************************/
-void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback)
+void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
 {
     btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
 
@@ -836,7 +836,7 @@ void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_inde
 **
 *******************************************************************************/
 void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
-                            UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback)
+                            UINT8 packet_payload, UINT8 phy, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
 {
     btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
     if (btsnd_hcic_ble_enhand_tx_test(tx_freq, test_data_len, packet_payload, phy) == FALSE) {

components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c

@@ -334,13 +334,13 @@ tBTM_STATUS BTM_BleConfigExtendedAdvDataRaw(BOOLEAN is_scan_rsp, UINT8 instance,
             }
         }
         if (!is_scan_rsp) {
-            if ((err = btsnd_hcic_ble_set_ext_adv_data(instance, operation, 0, send_data_len, &data[data_offset])) != HCI_SUCCESS) {
+            if ((err = btsnd_hcic_ble_set_ext_adv_data(instance, operation, 0, send_data_len, (data == NULL) ? NULL : &data[data_offset])) != HCI_SUCCESS) {
                 BTM_TRACE_ERROR("LE EA SetAdvData: cmd err=0x%x", err);
                 status = BTM_HCI_ERROR | err;
                 break;
             }
         } else {
-            if ((err = btsnd_hcic_ble_set_ext_adv_scan_rsp_data(instance, operation, 0, send_data_len, &data[data_offset])) != HCI_SUCCESS) {
+            if ((err = btsnd_hcic_ble_set_ext_adv_scan_rsp_data(instance, operation, 0, send_data_len, (data == NULL) ? NULL : &data[data_offset])) != HCI_SUCCESS) {
                 BTM_TRACE_ERROR("LE EA SetScanRspData: cmd err=0x%x", err);
                 status = BTM_HCI_ERROR | err;
                 break;
@@ -1900,7 +1900,6 @@ void btm_ble_cs_read_local_supp_caps_cmpl_evt(uint8_t *p)
         goto _error;
     }
 
-    STREAM_TO_UINT16(cb_params.cs_read_local_supp_caps.conn_handle, p);
     STREAM_TO_UINT8(cb_params.cs_read_local_supp_caps.num_config_supported, p);
     STREAM_TO_UINT16(cb_params.cs_read_local_supp_caps.max_consecutive_proc_supported, p);
     STREAM_TO_UINT8(cb_params.cs_read_local_supp_caps.num_ant_supported, p);
@@ -2011,6 +2010,7 @@ void btm_ble_cs_read_remote_fae_table_cmd_status(UINT8 status)
     tBTM_BLE_CS_READ_REMOTE_FAE_TAB_CMPL_EVT cs_read_remote_fae_tab = {0};
     if (status != HCI_SUCCESS) {
         cs_read_remote_fae_tab.status = (status | BTM_HCI_ERROR);
+        cs_read_remote_fae_tab.conn_handle = 0xFFFF;
         BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_CS_READ_REMOTE_FAE_TABLE_CMPL_EVT, (tBTM_BLE_5_GAP_CB_PARAMS *)&cs_read_remote_fae_tab);
     }
 }

components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c

@@ -1180,6 +1180,9 @@ void btm_ble_resolving_list_cleanup(void)
 {
     tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
 
+    p_q->q_next = 0;
+    p_q->q_pending = 0;
+
     if (p_q->resolve_q_random_pseudo) {
         osi_free(p_q->resolve_q_random_pseudo);
         p_q->resolve_q_random_pseudo = NULL;

components/bt/host/bluedroid/stack/btm/btm_devctl.c

@@ -120,13 +120,11 @@ void btm_dev_init (void)
 *******************************************************************************/
 static void btm_db_reset (void)
 {
-    tBTM_CMPL_CB    *p_cb;
-    tBTM_STATUS      status = BTM_DEV_RESET;
-
     btm_inq_db_reset();
 
 #if (CLASSIC_BT_INCLUDED == TRUE)
     if (btm_cb.devcb.p_rln_cmpl_cb) {
+        tBTM_CMPL_CB    *p_cb;
         p_cb = btm_cb.devcb.p_rln_cmpl_cb;
         btm_cb.devcb.p_rln_cmpl_cb = NULL;
 
@@ -137,12 +135,14 @@ static void btm_db_reset (void)
 #endif // (CLASSIC_BT_INCLUDED == TRUE)
 
     if (btm_cb.devcb.p_rssi_cmpl_cb) {
-        p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
+        tBTM_CMPL_CB     *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
-        btm_cb.devcb.p_rssi_cmpl_cb = NULL;
+        tBTM_RSSI_RESULTS results = {0};
 
-        if (p_cb) {
+        results.status = BTM_DEV_RESET;
-            (*p_cb)((tBTM_RSSI_RESULTS *) &status);
+        btm_cb.devcb.p_rssi_cmpl_cb = NULL;
-        }
+        btu_stop_timer(&btm_cb.devcb.rssi_timer);
+
+        (*p_cb)(&results);
     }
 }
 

components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h

@@ -444,7 +444,7 @@ void btm_ble_increment_sign_ctr(BD_ADDR bd_addr, BOOLEAN is_local );
 BOOLEAN btm_get_local_div (BD_ADDR bd_addr, UINT16 *p_div);
 BOOLEAN btm_ble_get_enc_key_type(BD_ADDR bd_addr, UINT8 *p_key_types);
 
-void btm_ble_test_command_complete(UINT8 *p);
+void btm_ble_test_command_complete(UINT8 *p, UINT16 len);
 void btm_ble_rand_enc_complete (UINT8 *p, UINT16 op_code, tBTM_RAND_ENC_CB *p_enc_cplt_cback);
 
 void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY_VALUE *p_keys, BOOLEAN pass_to_application);

components/bt/host/bluedroid/stack/btm/include/btm_int.h

@@ -291,8 +291,8 @@ DEV_CLASS            dev_class;         /* Local device class
 
 TIMER_LIST_ENT       ble_channels_timer;
 
-tBTM_CMPL_CB        *p_le_test_cmd_cmpl_cb;   /* Callback function to be called when
+tBTM_DTM_CMD_CMPL_CBACK *p_le_test_cmd_cmpl_cb; /* Callback function to be called when
-                                                  LE test mode command has been sent successfully */
+                                                   LE test mode command has been sent successfully */
 
 BD_ADDR                 read_tx_pwr_addr;   /* read TX power target address     */
 

components/bt/host/bluedroid/stack/include/stack/btm_api.h

@@ -173,7 +173,14 @@ typedef void (tBTM_VSC_CMPL_CB) (tBTM_VSC_CMPL *p1);
 */
 // typedef UINT8 (tBTM_FILTER_CB) (BD_ADDR bd_addr, DEV_CLASS dc);
 
-typedef void (tBTM_DTM_CMD_CMPL_CBACK) (void *p1);
+/*
+ * DTM (Direct Test Mode) command complete callback.
+ *
+ * The controller returns a variable-length parameter block depending on the
+ * specific LE test command. Propagate the parameter length so upper layers can
+ * validate before parsing and avoid OOB reads on malformed/truncated responses.
+ */
+typedef void (tBTM_DTM_CMD_CMPL_CBACK) (UINT8 *p, UINT16 len);
 
 typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status);
 

components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h

@@ -1528,7 +1528,6 @@ typedef struct {
 
 typedef struct {
     UINT8 status;
-    UINT16 conn_handle;
     UINT8 num_config_supported;
     UINT16 max_consecutive_proc_supported;
     UINT8 num_ant_supported;
@@ -2726,7 +2725,7 @@ void BTM_BleClearWhitelist(void);
 **               p_cmd_cmpl_cback - Command Complete callback
 **
 *******************************************************************************/
-void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback);
+void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
 
 
 /*******************************************************************************
@@ -2742,7 +2741,7 @@ void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback);
 **
 *******************************************************************************/
 void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
-                            UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback);
+                            UINT8 packet_payload, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
 
 /*******************************************************************************
 **
@@ -2753,7 +2752,7 @@ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
 ** Parameter       p_cmd_cmpl_cback - Command complete callback
 **
 *******************************************************************************/
-void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback);
+void BTM_BleTestEnd(tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
 
 /*******************************************************************************
 **
@@ -3087,9 +3086,9 @@ tBTM_STATUS BTM_BleEnableMonitorAdv(UINT8 enable);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_50_DTM_TEST_EN == TRUE)
-void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback);
+void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
 
-void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback);
+void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
 #endif // #if (BLE_50_DTM_TEST_EN == TRUE)
 
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)