From 1e02694c946eb3f5b5815a2b14cff08f03be7209 Mon Sep 17 00:00:00 2001 From: yangfeng Date: Wed, 25 Mar 2026 20:00:04 +0800 Subject: [PATCH 1/2] fix(bt): fix HFP bta component issues reported by AI review --- .../bt/host/bluedroid/bta/hf_ag/bta_ag_act.c | 36 +++-- .../bt/host/bluedroid/bta/hf_ag/bta_ag_api.c | 9 +- .../bt/host/bluedroid/bta/hf_ag/bta_ag_at.c | 24 ++- .../bt/host/bluedroid/bta/hf_ag/bta_ag_cfg.c | 2 +- .../bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c | 45 +++--- .../bt/host/bluedroid/bta/hf_ag/bta_ag_main.c | 25 +++- .../bt/host/bluedroid/bta/hf_ag/bta_ag_rfc.c | 14 ++ .../bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c | 15 +- .../bt/host/bluedroid/bta/hf_ag/bta_ag_sdp.c | 13 +- .../bta/hf_client/bta_hf_client_act.c | 70 ++++++--- .../bta/hf_client/bta_hf_client_api.c | 9 +- .../bta/hf_client/bta_hf_client_at.c | 139 +++++++++++++++--- .../bta/hf_client/bta_hf_client_cmd.c | 12 +- .../bta/hf_client/bta_hf_client_main.c | 14 +- .../bta/hf_client/bta_hf_client_rfc.c | 5 +- .../bta/hf_client/bta_hf_client_sco.c | 16 +- 16 files changed, 338 insertions(+), 110 deletions(-) diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c index c2e2773792c..fc385d7c3f5 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c @@ -91,6 +91,9 @@ const tBTA_AG_ATCMD_CBACK bta_ag_at_cback_tbl[BTA_AG_NUM_IDX] = static void bta_ag_cback_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data, tBTA_AG_STATUS status) { tBTA_AG_OPEN open; + if (p_scb->conn_service >= BTA_AG_NUM_IDX) { + return; + } /* call app callback with open event */ open.hdr.handle = bta_ag_scb_to_idx(p_scb); open.hdr.app_id = p_scb->app_id; @@ -102,7 +105,9 @@ static void bta_ag_cback_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data, tBTA_AG_ } else { bdcpy(open.bd_addr, p_scb->peer_addr); } - (*bta_ag_cb.p_cback)(BTA_AG_OPEN_EVT, (tBTA_AG *) &open); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_OPEN_EVT, (tBTA_AG *) &open); + } } /******************************************************************************* @@ -132,7 +137,9 @@ void bta_ag_register(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) reg.hdr.handle = bta_ag_scb_to_idx(p_scb); reg.hdr.app_id = p_scb->app_id; reg.hdr.status = BTA_AG_SUCCESS; - (*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG *) ®); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG *) ®); + } } /******************************************************************************* @@ -188,7 +195,7 @@ void bta_ag_start_dereg(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) *******************************************************************************/ void bta_ag_start_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) { - BD_ADDR pending_bd_addr; + BD_ADDR pending_bd_addr = {0}; /* store parameters */ if (p_data) { bdcpy(p_scb->peer_addr, p_data->api_open.bd_addr); @@ -199,7 +206,7 @@ void bta_ag_start_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) if (PORT_IsOpening (pending_bd_addr)) { /* Let the incoming connection goes through. */ /* Issue collision for this scb for now. */ - /* We will decide what to do when we find incoming connetion later. */ + /* We will decide what to do when we find incoming connection later. */ bta_ag_collision_cback (0, BTA_ID_AG, 0, p_scb->peer_addr); return; } @@ -398,7 +405,9 @@ void bta_ag_rfc_close(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) bta_sys_conn_close(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr); /* call close cback */ - (*bta_ag_cb.p_cback)(BTA_AG_CLOSE_EVT, (tBTA_AG *) &close); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_CLOSE_EVT, (tBTA_AG *) &close); + } /* if not deregistering (deallocating) reopen registered servers */ if (p_scb->dealloc == FALSE) { @@ -444,6 +453,9 @@ void bta_ag_rfc_close(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) *******************************************************************************/ void bta_ag_rfc_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) { + if (p_scb->conn_service >= BTA_AG_NUM_IDX) { + return; + } /* initialize AT feature variables */ p_scb->clip_enabled = FALSE; p_scb->ccwa_enabled = FALSE; @@ -670,7 +682,7 @@ void bta_ag_post_sco_close(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) case BTA_AG_POST_SCO_CALL_END_INCALL: { bta_ag_send_call_inds(p_scb, BTA_AG_END_CALL_RES); - /* Sending callsetup IND and Ring were defered to after SCO close. */ + /* Sending callsetup IND and Ring were deferred to after SCO close. */ bta_ag_send_call_inds(p_scb, BTA_AG_IN_CALL_RES); if (bta_ag_inband_enabled(p_scb) && !(p_scb->features & BTA_AG_FEAT_NOSCO)) { @@ -722,7 +734,9 @@ void bta_ag_svc_conn_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) (p_scb->callsetup_ind != BTA_AG_CALLSETUP_NONE)) { bta_sys_sco_use(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr); } - (*bta_ag_cb.p_cback)(BTA_AG_CONN_EVT, (tBTA_AG *) &evt); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_CONN_EVT, (tBTA_AG *) &evt); + } } } @@ -794,7 +808,9 @@ void bta_ag_setcodec(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) (codec_type != BTA_AG_CODEC_MSBC)) { val.hdr.status = BTA_AG_FAIL_RESOURCES; APPL_TRACE_ERROR("%s error: unsupported codec type %d", __func__, codec_type); - (*bta_ag_cb.p_cback)(BTA_AG_WBS_EVT, (tBTA_AG *) &val); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_WBS_EVT, (tBTA_AG *) &val); + } return; } @@ -809,7 +825,9 @@ void bta_ag_setcodec(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) val.hdr.status = BTA_AG_FAIL_RESOURCES; APPL_TRACE_ERROR("%s error: unsupported codec type %d",__func__, codec_type); } - (*bta_ag_cb.p_cback)(BTA_AG_WBS_EVT, (tBTA_AG *) &val); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_WBS_EVT, (tBTA_AG *) &val); + } #endif } diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_api.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_api.c index 4b1d91eef54..2c5485d3578 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_api.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_api.c @@ -67,14 +67,17 @@ tBTA_STATUS BTA_AgEnable(tBTA_AG_PARSE_MODE parse_mode, tBTA_AG_CBACK *p_cback) return BTA_FAILURE; } } - /* register with BTA system manager */ - bta_sys_register(BTA_ID_AG, &bta_ag_reg); if ((p_buf = (tBTA_AG_API_ENABLE *) osi_malloc(sizeof(tBTA_AG_API_ENABLE))) != NULL) { + /* register with BTA system manager */ + bta_sys_register(BTA_ID_AG, &bta_ag_reg); + p_buf->hdr.event = BTA_AG_API_ENABLE_EVT; p_buf->parse_mode = parse_mode; p_buf->p_cback = p_cback; bta_sys_sendmsg(p_buf); + } else { + return BTA_NO_RESOURCES; } return BTA_SUCCESS; } @@ -121,7 +124,7 @@ void BTA_AgRegister(tBTA_SERVICE_MASK services, tBTA_SEC sec_mask,tBTA_AG_FEAT f p_buf->services = services; p_buf->app_id = app_id; for (i = 0; i < BTA_AG_NUM_IDX; i++) { - if(p_service_names[i]) { + if (p_service_names != NULL && p_service_names[i]) { BCM_STRNCPY_S(p_buf->p_name[i], p_service_names[i], BTA_SERVICE_NAME_LEN); p_buf->p_name[i][BTA_SERVICE_NAME_LEN] = '\0'; } else { diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_at.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_at.c index 82066d8f793..bebd282a441 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_at.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_at.c @@ -122,20 +122,30 @@ void bta_ag_process_at(tBTA_AG_AT_CB *p_cb) if (int_arg < (INT16) p_cb->p_at_tbl[idx].min || int_arg > (INT16) p_cb->p_at_tbl[idx].max) { /* arg out of range; error */ - (*p_cb->p_err_cback)(p_cb->p_user, FALSE, NULL); + if (p_cb->p_err_cback) { + (*p_cb->p_err_cback)(p_cb->p_user, FALSE, NULL); + } } else { - (*p_cb->p_cmd_cback)(p_cb->p_user, idx, arg_type, p_arg, int_arg); + if (p_cb->p_cmd_cback) { + (*p_cb->p_cmd_cback)(p_cb->p_user, idx, arg_type, p_arg, int_arg); + } } } else { - (*p_cb->p_cmd_cback)(p_cb->p_user, idx, arg_type, p_arg, int_arg); + if (p_cb->p_cmd_cback) { + (*p_cb->p_cmd_cback)(p_cb->p_user, idx, arg_type, p_arg, int_arg); + } } } else { /* else error */ - (*p_cb->p_err_cback)(p_cb->p_user, FALSE, NULL); + if (p_cb->p_err_cback) { + (*p_cb->p_err_cback)(p_cb->p_user, FALSE, NULL); + } } } else { /* else no match call error callback */ - (*p_cb->p_err_cback)(p_cb->p_user, TRUE, p_cb->p_cmd_buf); + if (p_cb->p_err_cback) { + (*p_cb->p_err_cback)(p_cb->p_user, TRUE, p_cb->p_cmd_buf); + } } } @@ -185,7 +195,9 @@ void bta_ag_at_parse(tBTA_AG_AT_CB *p_cb, char *p_buf, UINT16 len) p_cb->cmd_pos = 0; } else if( p_cb->p_cmd_buf[p_cb->cmd_pos] == 0x1A || p_cb->p_cmd_buf[p_cb->cmd_pos] == 0x1B) { p_cb->p_cmd_buf[++p_cb->cmd_pos] = 0; - (*p_cb->p_err_cback)(p_cb->p_user, TRUE, p_cb->p_cmd_buf); + if (p_cb->p_err_cback) { + (*p_cb->p_err_cback)(p_cb->p_user, TRUE, p_cb->p_cmd_buf); + } p_cb->cmd_pos = 0; } else { ++p_cb->cmd_pos; diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cfg.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cfg.c index 3c059cea722..fd15b2e39b4 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cfg.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cfg.c @@ -31,7 +31,7 @@ #if (BTA_AG_INCLUDED == TRUE) #ifndef BTA_AG_CIND_INFO -#define BTA_AG_CIND_INFO "(\"call\",(0,1)),(\"callsetup\",(0-3)),(\"service\",(0-3)),(\"signal\",(0-6)),(\"roam\",(0,1)),(\"battchg\",(0-5)),(\"callheld\",(0-2))" +#define BTA_AG_CIND_INFO "(\"call\",(0,1)),(\"callsetup\",(0-3)),(\"service\",(0-1)),(\"signal\",(0-5)),(\"roam\",(0,1)),(\"battchg\",(0-5)),(\"callheld\",(0-2))" #endif #ifndef BTA_AG_CONN_TIMEOUT diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c index 6bccfe1b7ea..5a3ee7a05d0 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c @@ -358,7 +358,7 @@ void bta_hf_ag_bqb_brsf_ctrl(BOOLEAN enable) #endif /* BT_HF_AG_BQB_INCLUDED */ /******************************************* -* Funcitons Result +* Functions Result ********************************************/ /******************************************************************************* ** @@ -376,7 +376,7 @@ static void bta_ag_send_result(tBTA_AG_SCB *p_scb, UINT8 code, char *p_arg, INT1 char *p = buf; UINT16 len; #if (BTIF_TRACE_DEBUG == TRUE) - memset(buf, NULL, sizeof(buf)); + memset(buf, 0, sizeof(buf)); #endif /* init with \r\n */ *p++ = '\r'; @@ -444,7 +444,7 @@ static void bta_ag_send_multi_result(tBTA_AG_SCB *p_scb, tBTA_AG_MULTI_RESULT_CB } #if defined(BTA_AG_RESULT_DEBUG) && (BTA_AG_RESULT_DEBUG == TRUE) - memset(buf, NULL, sizeof(buf)); + memset(buf, 0, sizeof(buf)); #endif while(res_idx < m_res_cb->num_result) { @@ -604,13 +604,14 @@ static BOOLEAN bta_ag_parse_cmer(char *p_s, BOOLEAN *p_enabled) for (i = 0; i < 4; i++) { /* skip to comma delimiter */ for (p = p_s; *p != ',' && *p != 0; p++); + if (*p == 0) { + n[i] = utl_str2int(p_s); + break; + } /* get integer value */ *p = 0; n[i] = utl_str2int(p_s); p_s = p + 1; - if (p_s == 0) { - break; - } } /* process values */ if (n[0] < 0 || n[3] < 0) { @@ -721,9 +722,9 @@ static tBTA_AG_PEER_CODEC bta_ag_parse_bac(tBTA_AG_SCB *p_scb, char *p_s) *******************************************************************************/ static void bta_ag_process_unat_res(char *unat_result) { - UINT8 str_leng; - UINT8 i = 0; - UINT8 j = 0; + size_t str_leng; + size_t i = 0; + size_t j = 0; UINT8 pairs_of_nl_cr; char trim_data[BTA_AG_AT_MAX_LEN]; @@ -737,16 +738,18 @@ static void bta_ag_process_unat_res(char *unat_result) while(unat_result[0] =='\r' && unat_result[1] =='\n' && unat_result[str_leng-2] =='\r' && unat_result[str_leng-1] =='\n') { pairs_of_nl_cr = 1; - for (i=0;i<(str_leng-4*pairs_of_nl_cr);i++) { - trim_data[j++] = unat_result[i+pairs_of_nl_cr*2]; + for (i = 0; i < (str_leng - 4 * pairs_of_nl_cr); i++) { + trim_data[j++] = unat_result[i + pairs_of_nl_cr * 2]; } /* Add EOF */ - trim_data[j] = '\0'; + if (j < BTA_AG_AT_MAX_LEN) { + trim_data[j] = '\0'; + } str_leng = str_leng - 4; BCM_STRNCPY_S(unat_result, trim_data, BTA_AG_AT_MAX_LEN); - i=0; - j=0; - if(str_leng <4) { + i = 0; + j = 0; + if (str_leng < 4) { return; } } @@ -827,7 +830,9 @@ void bta_ag_at_hsp_cback(tBTA_AG_SCB *p_scb, UINT16 cmd, UINT8 arg_type, BCM_STRNCPY_S(val.str, p_arg, BTA_AG_AT_MAX_LEN); val.str[BTA_AG_AT_MAX_LEN] = '\0'; /* call callback with event */ - (*bta_ag_cb.p_cback)(bta_ag_hsp_cb_evt[cmd], (tBTA_AG *) &val); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(bta_ag_hsp_cb_evt[cmd], (tBTA_AG *) &val); + } } /******************************************************************************* @@ -1233,7 +1238,9 @@ void bta_ag_at_hfp_cback(tBTA_AG_SCB *p_scb, UINT16 cmd, UINT8 arg_type, } /* call callback */ if (event != 0) { - (*bta_ag_cb.p_cback)(event, (tBTA_AG *) &val); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(event, (tBTA_AG *) &val); + } } } @@ -1264,7 +1271,9 @@ void bta_ag_at_err_cback(tBTA_AG_SCB *p_scb, BOOLEAN unknown, char *p_arg) val.num = 0; BCM_STRNCPY_S(val.str, p_arg, BTA_AG_AT_MAX_LEN); val.str[BTA_AG_AT_MAX_LEN] = '\0'; - (*bta_ag_cb.p_cback)(BTA_AG_AT_UNAT_EVT, (tBTA_AG *) &val); + if (bta_ag_cb.p_cback) { + (*bta_ag_cb.p_cback)(BTA_AG_AT_UNAT_EVT, (tBTA_AG *) &val); + } } else { bta_ag_send_error(p_scb, BTA_AG_ERR_OP_NOT_SUPPORTED); } diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_main.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_main.c index bcf3cc6ec08..760c828a9be 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_main.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_main.c @@ -360,9 +360,9 @@ static char *bta_ag_evt_str(UINT16 event, tBTA_AG_RES result) case BTA_AG_API_DISABLE_EVT: return "Disable AG"; case BTA_AG_CI_SCO_DATA_EVT: - return "SCO data Callin"; + return "SCO data Call in"; case BTA_AG_CI_SLC_READY_EVT: - return "SLC Ready Callin"; + return "SLC Ready Call in"; case BTA_AG_PKT_STAT_NUMS_GET_EVT: return "Get Packet Nums"; default: @@ -504,8 +504,15 @@ void bta_ag_scb_dealloc(tBTA_AG_SCB *p_scb) *******************************************************************************/ UINT16 bta_ag_scb_to_idx(tBTA_AG_SCB *p_scb) { + if (p_scb == NULL) { + return 0; + } /* use array arithmetic to determine index */ - return ((UINT16) (p_scb - bta_ag_cb.scb)) + 1; + UINT16 idx = ((UINT16) (p_scb - bta_ag_cb.scb)) + 1; + if (idx < 1 || idx > BTA_AG_NUM_SCB) { + return 0; + } + return idx; } /******************************************************************************* @@ -718,7 +725,7 @@ void bta_ag_collision_cback (tBTA_SYS_CONN_STATUS status, UINT8 id, UINT8 app_id } /* Start timer to han */ p_scb->colli_timer.p_cback = (TIMER_CBACK*)&bta_ag_colli_timer_cback; - p_scb->colli_timer.param = (INT32)p_scb; + p_scb->colli_timer.param = (UINT32)p_scb; bta_sys_start_timer(&p_scb->colli_timer, 0, BTA_AG_COLLISION_TIMER); p_scb->colli_tmr_on = TRUE; } @@ -774,7 +781,7 @@ static void bta_ag_api_enable(tBTA_AG_DATA *p_data) bta_ag_cb.scb->negotiated_codec = BTM_SCO_CODEC_CVSD; } - /* set deault setting for eSCO/SCO */ + /* set default setting for eSCO/SCO */ BTM_WriteVoiceSettings(AG_VOICE_SETTINGS); bta_sys_collision_register (BTA_ID_AG, bta_ag_collision_cback); /* call callback with enable event */ @@ -892,12 +899,16 @@ void bta_ag_sm_execute(tBTA_AG_SCB *p_scb, UINT16 event, tBTA_AG_DATA *p_data) #if BTA_AG_DEBUG == TRUE UINT16 in_event = event; UINT8 in_state = p_scb->state; + tBTA_AG_RES dbg_api_result = (tBTA_AG_RES)0; + if (p_data != NULL && in_event == BTA_AG_API_RESULT_EVT) { + dbg_api_result = p_data->api_result.result; + } /* Ignore displaying of AT results when not connected (Ignored in state machine) */ if (in_event != BTA_AG_API_RESULT_EVT || p_scb->state == BTA_AG_OPEN_ST) { APPL_TRACE_EVENT("AG evt (hdl 0x%04x): State %d (%s), Event 0x%04x (%s)", bta_ag_scb_to_idx(p_scb), p_scb->state, bta_ag_state_str(p_scb->state), - event, bta_ag_evt_str(event, p_data->api_result.result)); + event, bta_ag_evt_str(event, dbg_api_result)); } #else APPL_TRACE_EVENT("AG evt (hdl 0x%04x): State %d, Event 0x%04x", @@ -925,7 +936,7 @@ void bta_ag_sm_execute(tBTA_AG_SCB *p_scb, UINT16 event, tBTA_AG_DATA *p_data) APPL_TRACE_EVENT("BTA AG State Change: [%s] -> [%s] after Event [%s]", bta_ag_state_str(in_state), bta_ag_state_str(p_scb->state), - bta_ag_evt_str(in_event, p_data->api_result.result)); + bta_ag_evt_str(in_event, dbg_api_result)); } #endif } diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_rfc.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_rfc.c index 49ca54af0e9..2bfdd430ea2 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_rfc.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_rfc.c @@ -252,6 +252,10 @@ void bta_ag_setup_port(tBTA_AG_SCB *p_scb, UINT16 handle) { UINT16 i = bta_ag_scb_to_idx(p_scb) - 1; + if (i >= BTA_AG_NUM_SCB) { + return; + } + /* set up data callback if using pass through mode */ if (bta_ag_cb.parse_mode == BTA_AG_PASS_THROUGH) { PORT_SetDataCallback(handle, bta_ag_data_cback_tbl[i]); @@ -274,6 +278,10 @@ void bta_ag_start_servers(tBTA_AG_SCB *p_scb, tBTA_SERVICE_MASK services) { int bta_ag_port_status; + if (bta_ag_scb_to_idx(p_scb) < 1 || bta_ag_scb_to_idx(p_scb) > BTA_AG_NUM_SCB) { + return; + } + services >>= BTA_HSP_SERVICE_ID; for (int i = 0; i < BTA_AG_NUM_IDX && services != 0; i++, services >>= 1) { /* if service is set in mask */ @@ -353,6 +361,12 @@ BOOLEAN bta_ag_is_server_closed (tBTA_AG_SCB *p_scb) *******************************************************************************/ void bta_ag_rfc_do_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) { + if (bta_ag_scb_to_idx(p_scb) < 1 || bta_ag_scb_to_idx(p_scb) > BTA_AG_NUM_SCB) { + APPL_TRACE_ERROR("bta_ag_rfc_do_open: EINVAL idx %u", bta_ag_scb_to_idx(p_scb)); + bta_ag_sm_execute(p_scb, BTA_AG_RFC_CLOSE_EVT, p_data); + return; + } + BTM_SetSecurityLevel(TRUE, "", bta_ag_sec_id[p_scb->conn_service], p_scb->cli_sec_mask, BT_PSM_RFCOMM, BTM_SEC_PROTO_RFCOMM, p_scb->peer_scn); diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c index fe494ff3a19..8892edf245a 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c @@ -199,7 +199,7 @@ static void bta_ag_sco_conn_cback(UINT16 sco_idx) handle = 0; } - if (handle != 0) + if (handle != 0 && p_scb) { BTM_ReadEScoLinkParms(sco_idx, &sco_data); @@ -637,10 +637,13 @@ static void bta_ag_create_sco(tBTA_AG_SCB *p_scb, BOOLEAN is_orig) #if (BTM_SCO_HCI_INCLUDED == TRUE) #if (BTM_WBS_INCLUDED == TRUE) - if (esco_codec == BTA_AG_CODEC_MSBC) - pcm_sample_rate = BTA_HFP_SCO_SAMP_RATE_16K; + if (esco_codec == BTA_AG_CODEC_MSBC) { + pcm_sample_rate = BTA_HFP_SCO_SAMP_RATE_16K; + } else #endif - pcm_sample_rate = BTA_HFP_SCO_SAMP_RATE_8K; + { + pcm_sample_rate = BTA_HFP_SCO_SAMP_RATE_8K; + } sco_route = bta_ag_sco_co_init(pcm_sample_rate, pcm_sample_rate, &codec_info, p_scb->app_id); #endif @@ -751,7 +754,7 @@ void bta_ag_codec_negotiate(tBTA_AG_SCB *p_scb) /* Start timer to handle timeout */ p_scb->cn_timer.p_cback = (TIMER_CBACK*)&bta_ag_cn_timer_cback; - p_scb->cn_timer.param = (INT32)p_scb; + p_scb->cn_timer.param = (UINT32)p_scb; bta_sys_start_timer(&p_scb->cn_timer, 0, BTA_AG_CODEC_NEGO_TIMEOUT); } else @@ -1648,7 +1651,7 @@ void bta_ag_sco_conn_close(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) *******************************************************************************/ void bta_ag_sco_conn_rsp(tBTA_AG_SCB *p_scb, tBTM_ESCO_CONN_REQ_EVT_DATA *p_data) { - tBTM_ESCO_PARAMS resp; + tBTM_ESCO_PARAMS resp = {0}; UINT8 hci_status = HCI_SUCCESS; #if (BTM_SCO_HCI_INCLUDED == TRUE) tBTA_HFP_CODEC_INFO codec_info = {BTA_HFP_SCO_CODEC_PCM}; diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sdp.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sdp.c index 0b02557b08d..9864f663908 100644 --- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sdp.c +++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sdp.c @@ -92,6 +92,10 @@ static void bta_ag_sdp_cback(UINT16 status, UINT8 idx) p_buf->hdr.layer_specific = idx; p_buf->status = status; bta_sys_sendmsg(p_buf); + } else { + APPL_TRACE_ERROR("bta_ag_sdp_cback: ENOMEM"); + bta_ag_free_db(p_scb, NULL); + bta_ag_sm_execute(p_scb, BTA_AG_DISC_FAIL_EVT, NULL); } } } @@ -243,16 +247,13 @@ void bta_ag_del_records(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data) UNUSED(p_data); /* get services of all other registered servers */ - for (i = 0; i < BTA_AG_NUM_IDX; i++) { + for (i = 0; i < BTA_AG_NUM_SCB; i++, p++) { if (p_scb == p) { continue; } if (p->in_use && p->dealloc == FALSE) { others |= p->reg_services; } - if (i < BTA_AG_NUM_SCB) { - p++; - } } others >>= BTA_HSP_SERVICE_ID; services = p_scb->reg_services >> BTA_HSP_SERVICE_ID; @@ -414,7 +415,9 @@ void bta_ag_do_disc(tBTA_AG_SCB *p_scb, tBTA_SERVICE_MASK service) if(p_scb->p_disc_db) { /* set up service discovery database; attr happens to be attr_list len */ uuid_list[0].len = LEN_UUID_16; - uuid_list[1].len = LEN_UUID_16; + if (num_uuid >= 2) { + uuid_list[1].len = LEN_UUID_16; + } db_inited = SDP_InitDiscoveryDb(p_scb->p_disc_db, BTA_AG_DISC_BUF_SIZE, num_uuid, uuid_list, num_attr, attr_list); } diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_act.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_act.c index 930f30a57d4..680eee6e78b 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_act.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_act.c @@ -84,7 +84,9 @@ void bta_hf_client_register(tBTA_HF_CLIENT_DATA *p_data) /* call app callback with register event */ evt.status = BTA_HF_CLIENT_SUCCESS; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_REGISTER_EVT, &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_REGISTER_EVT, &evt); + } } /******************************************************************************* @@ -177,7 +179,7 @@ void bta_hf_client_start_close(tBTA_HF_CLIENT_DATA *p_data) *******************************************************************************/ void bta_hf_client_start_open(tBTA_HF_CLIENT_DATA *p_data) { - BD_ADDR pending_bd_addr; + BD_ADDR pending_bd_addr = {0}; /* store parameters */ if (p_data) { @@ -229,7 +231,9 @@ static void bta_hf_client_cback_open(tBTA_HF_CLIENT_DATA *p_data, tBTA_HF_CLIENT bdcpy(evt.bd_addr, bta_hf_client_cb.scb.peer_addr); } - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_OPEN_EVT, &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_OPEN_EVT, &evt); + } } /******************************************************************************* @@ -352,11 +356,19 @@ void bta_hf_client_disc_fail(tBTA_HF_CLIENT_DATA *p_data) { UNUSED(p_data); + bta_hf_client_cb.scb.conn_handle = 0; + bta_hf_client_cb.scb.peer_features = 0; + bta_hf_client_cb.scb.chld_features = 0; + bta_hf_client_cb.scb.role = BTA_HF_CLIENT_ACP; + bta_hf_client_cb.scb.svc_conn = FALSE; + bta_hf_client_cb.scb.send_at_reply = FALSE; + bta_hf_client_cb.scb.negotiated_codec = BTM_SCO_CODEC_CVSD; + + bta_hf_client_at_reset(); + /* reopen server */ bta_hf_client_start_server(); - /* reinitialize stuff */ - /* call open cback w. failure */ bta_hf_client_cback_open(NULL, BTA_HF_CLIENT_FAIL_SDP); } @@ -404,10 +416,13 @@ void bta_hf_client_rfc_close(tBTA_HF_CLIENT_DATA *p_data) bta_sys_conn_close(BTA_ID_HS, 1, bta_hf_client_cb.scb.peer_addr); /* call close cback */ - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CLOSE_EVT, NULL); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CLOSE_EVT, NULL); + } /* if not deregistering reopen server */ if (bta_hf_client_cb.scb.deregister == FALSE) { + bta_sys_sco_unuse(BTA_ID_HS, 1, bta_hf_client_cb.scb.peer_addr); /* Clear peer bd_addr so instance can be reused */ bdcpy(bta_hf_client_cb.scb.peer_addr, bd_addr_null); @@ -418,8 +433,6 @@ void bta_hf_client_rfc_close(tBTA_HF_CLIENT_DATA *p_data) /* Make sure SCO is shutdown */ bta_hf_client_sco_shutdown(NULL); - - bta_sys_sco_unuse(BTA_ID_HS, 1, bta_hf_client_cb.scb.peer_addr); } /* else close port and deallocate scb */ else { @@ -548,7 +561,9 @@ void bta_hf_client_svc_conn_open(tBTA_HF_CLIENT_DATA *p_data) evt.peer_feat = bta_hf_client_cb.scb.peer_features; evt.chld_feat = bta_hf_client_cb.scb.chld_features; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CONN_EVT, &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CONN_EVT, &evt); + } } } @@ -570,7 +585,9 @@ void bta_hf_client_ind(tBTA_HF_CLIENT_IND_TYPE type, UINT16 value) evt.type = type; evt.value = value; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_IND_EVT, &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_IND_EVT, &evt); + } } /******************************************************************************* @@ -592,7 +609,9 @@ void bta_hf_client_evt_val(tBTA_HF_CLIENT_EVT type, UINT16 value) evt.value = value; - (*bta_hf_client_cb.p_cback)(type, &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(type, &evt); + } } /******************************************************************************* @@ -613,7 +632,9 @@ void bta_hf_client_operator_name(char *name) strlcpy(evt->name, name, BTA_HF_CLIENT_OPERATOR_NAME_LEN + 1); evt->name[BTA_HF_CLIENT_OPERATOR_NAME_LEN] = '\0'; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_OPERATOR_NAME_EVT, evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_OPERATOR_NAME_EVT, evt); + } osi_free(evt); } else { APPL_TRACE_ERROR("No mem: %s", __func__); @@ -639,7 +660,9 @@ void bta_hf_client_clip(char *number) strlcpy(evt->number, number, BTA_HF_CLIENT_NUMBER_LEN + 1); evt->number[BTA_HF_CLIENT_NUMBER_LEN] = '\0'; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CLIP_EVT, evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CLIP_EVT, evt); + } osi_free(evt); } else { APPL_TRACE_ERROR("No mem: %s", __func__); @@ -664,8 +687,9 @@ void bta_hf_client_ccwa(char *number) strlcpy(evt->number, number, BTA_HF_CLIENT_NUMBER_LEN + 1); evt->number[BTA_HF_CLIENT_NUMBER_LEN] = '\0'; - - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CCWA_EVT, evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CCWA_EVT, evt); + } osi_free(evt); } else { APPL_TRACE_ERROR("No mem: %s", __func__); @@ -691,7 +715,9 @@ void bta_hf_client_at_result(tBTA_HF_CLIENT_AT_RESULT_TYPE type, UINT16 cme) evt.type = type; evt.cme = cme; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_AT_RESULT_EVT, &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_AT_RESULT_EVT, &evt); + } } /******************************************************************************* @@ -720,7 +746,9 @@ void bta_hf_client_clcc(UINT32 idx, BOOLEAN incoming, UINT8 status, BOOLEAN mpty evt->number[BTA_HF_CLIENT_NUMBER_LEN] = '\0'; } - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CLCC_EVT, evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CLCC_EVT, evt); + } osi_free(evt); } else { APPL_TRACE_ERROR("No mem, %s\n", __func__); @@ -747,7 +775,9 @@ void bta_hf_client_cnum(char *number, UINT16 service) strlcpy(evt->number, number, BTA_HF_CLIENT_NUMBER_LEN + 1); evt->number[BTA_HF_CLIENT_NUMBER_LEN] = '\0'; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CNUM_EVT, evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_CNUM_EVT, evt); + } osi_free(evt); } else { APPL_TRACE_ERROR("No mem, %s", __func__); @@ -772,7 +802,9 @@ void bta_hf_client_binp(char *number) strlcpy(evt->number, number, BTA_HF_CLIENT_NUMBER_LEN + 1); evt->number[BTA_HF_CLIENT_NUMBER_LEN] = '\0'; - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_BINP_EVT, evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_BINP_EVT, evt); + } osi_free(evt); } else { APPL_TRACE_ERROR("No mem: %s", __func__); diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c index 6149d8c4189..bcb456ab8f0 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c @@ -90,13 +90,16 @@ tBTA_STATUS BTA_HfClientEnable(tBTA_HF_CLIENT_CBACK *p_cback) return BTA_FAILURE; } - /* register with BTA system manager */ - bta_sys_register(BTA_ID_HS, &bta_hf_client_reg); - if ((p_buf = (tBTA_HF_CLIENT_API_ENABLE *) osi_malloc(sizeof(tBTA_HF_CLIENT_API_ENABLE))) != NULL) { + /* register with BTA system manager */ + bta_sys_register(BTA_ID_HS, &bta_hf_client_reg); + p_buf->hdr.event = BTA_HF_CLIENT_API_ENABLE_EVT; p_buf->p_cback = p_cback; bta_sys_sendmsg(p_buf); + } else { + APPL_TRACE_ERROR("BTA_HfClientEnable ENOMEM"); + return BTA_NO_RESOURCES; } return BTA_SUCCESS; diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c index bd5bca86588..4b89796e252 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c @@ -174,6 +174,11 @@ static void bta_hf_client_start_at_resp_timer(void) static void bta_hf_client_send_at(tBTA_HF_CLIENT_AT_CMD cmd, char *buf, UINT16 buf_len) { + if (buf_len > BTA_HF_CLIENT_AT_MAX_LEN) { + APPL_TRACE_ERROR("hf_client_send_at EINVAL buf_len %u", buf_len); + buf_len = BTA_HF_CLIENT_AT_MAX_LEN; + } + if ((bta_hf_client_cb.scb.at_cb.current_cmd == BTA_HF_CLIENT_AT_NONE || bta_hf_client_cb.scb.svc_conn == FALSE) && bta_hf_client_cb.scb.at_cb.hold_timer_on == FALSE) { @@ -202,6 +207,16 @@ static void bta_hf_client_send_at(tBTA_HF_CLIENT_AT_CMD cmd, char *buf, UINT16 b bta_hf_client_queue_at(cmd, buf, buf_len); } +static void bta_hf_client_send_at_nomem_err_print(char *cmd) +{ + APPL_TRACE_ERROR("AT command '%s' no mem", cmd ? cmd : "NULL"); +} + +static void bta_hf_client_send_at_len_err_print(char *cmd, int at_len) +{ + APPL_TRACE_ERROR("AT command '%s' len err: length=%d", cmd ? cmd : "NULL", at_len); +} + static void bta_hf_client_send_queued_at(void) { tBTA_HF_CLIENT_AT_QCMD *cur = bta_hf_client_cb.scb.at_cb.queued_cmd; @@ -406,7 +421,13 @@ static void bta_hf_client_handle_cind_value(UINT32 index, UINT32 value) } /* get the real array index from lookup table */ - index = bta_hf_client_cb.scb.at_cb.indicator_lookup[index]; + { + int lk = bta_hf_client_cb.scb.at_cb.indicator_lookup[index]; + if (lk < 0 || lk >= (int)BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT) { + return; + } + index = (UINT32)lk; + } /* Ignore out of range values */ if (value > bta_hf_client_indicators[index].max || @@ -715,7 +736,7 @@ static char *bta_hf_client_parse_cind_list(char *buffer) osi_free(name); - if (res > 2) { + if (res > 2 && offset > 0) { AT_CHECK_RN(buffer); return buffer; } @@ -1396,7 +1417,7 @@ void bta_hf_client_send_at_brsf(void) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("brsf"); return; } @@ -1404,6 +1425,13 @@ void bta_hf_client_send_at_brsf(void) at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+BRSF=%u\r", bta_hf_client_cb.scb.features); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("brsf", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_BRSF , buf, at_len); osi_free(buf); } @@ -1429,12 +1457,19 @@ void bta_hf_client_send_at_bcs(UINT32 codec) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("bcs"); return; } at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+BCS=%u\r", codec); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("bcs", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_BCS, buf, at_len); osi_free(buf); } @@ -1478,7 +1513,7 @@ void bta_hf_client_send_at_chld(char cmd, UINT32 idx) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("chld"); return; } @@ -1488,6 +1523,13 @@ void bta_hf_client_send_at_chld(char cmd, UINT32 idx) at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+CHLD=%c\r", cmd); } + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("chld", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_CHLD, buf, at_len); osi_free(buf); } @@ -1567,9 +1609,16 @@ void bta_hf_client_send_at_clcc(void) void bta_hf_client_send_at_xapl(char *information, UINT32 features) { - APPL_TRACE_DEBUG("%s(%s, %u)", __FUNCTION__, information, features); + char *buf; + const char *inf = (information != NULL) ? information : ""; - char *buf = osi_malloc(BTA_HF_CLIENT_AT_MAX_LEN); + APPL_TRACE_DEBUG("%s(%s, %u)", __FUNCTION__, inf, features); + + buf = osi_malloc(BTA_HF_CLIENT_AT_MAX_LEN); + if (buf == NULL) { + bta_hf_client_send_at_nomem_err_print("xapl"); + return; + } /* Format: AT+XAPL=vendorID-productID-version,features @@ -1586,7 +1635,8 @@ void bta_hf_client_send_at_xapl(char *information, UINT32 features) *All other values are reserved. */ - snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+XAPL=%s,%u\r", information, features); + snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+XAPL=%.*s,%u\r", + BTA_HF_CLIENT_AT_MAX_LEN - 48, inf, features); bta_hf_client_send_at(BTA_HF_CLIENT_AT_XAPL, buf, strlen(buf)); osi_free(buf); @@ -1597,6 +1647,10 @@ void bta_hf_client_send_at_iphoneaccev(UINT32 bat_level, BOOLEAN docked) APPL_TRACE_DEBUG("%s(%u, %s)", __FUNCTION__, bat_level, docked ? "docked" : "undocked"); char *buf = osi_malloc(BTA_HF_CLIENT_AT_MAX_LEN); + if (buf == NULL) { + bta_hf_client_send_at_nomem_err_print("iphoneaccev"); + return; + } /* Format: AT+IPHONEACCEV=Number of key/value pairs,key1,val1,key2,val2,... @@ -1636,13 +1690,20 @@ void bta_hf_client_send_at_vgs(UINT32 volume) char *buf = osi_malloc(BTA_HF_CLIENT_AT_MAX_LEN); int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("vgs"); return; } APPL_TRACE_DEBUG("%s", __FUNCTION__); at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+VGS=%u\r", volume); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("vgs", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_VGS, buf, at_len); osi_free(buf); } @@ -1653,13 +1714,20 @@ void bta_hf_client_send_at_vgm(UINT32 volume) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("vgm"); return; } APPL_TRACE_DEBUG("%s", __FUNCTION__); at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+VGM=%u\r", volume); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("vgm", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_VGM, buf, at_len); osi_free(buf); } @@ -1670,18 +1738,24 @@ void bta_hf_client_send_at_atd(char *number, UINT32 memory) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("atd"); return; } APPL_TRACE_DEBUG("%s", __FUNCTION__); - if (number[0] != '\0') { - at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "ATD%s;\r", number); + if (number && number[0] != '\0') { + at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "ATD%.*s;\r", + (int)(BTA_HF_CLIENT_AT_MAX_LEN - 8), number); } else { at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "ATD>%u;\r", memory); } - at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("atd", at_len); + osi_free(buf); + return; + } bta_hf_client_send_at(BTA_HF_CLIENT_AT_ATD, buf, at_len); osi_free(buf); @@ -1726,7 +1800,7 @@ void bta_hf_client_send_at_btrh(BOOLEAN query, UINT32 val) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("btrh"); return; } APPL_TRACE_DEBUG("%s", __FUNCTION__); @@ -1737,6 +1811,13 @@ void bta_hf_client_send_at_btrh(BOOLEAN query, UINT32 val) at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+BTRH=%u\r", val); } + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("btrh", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_BTRH, buf, at_len); osi_free(buf); } @@ -1746,13 +1827,20 @@ void bta_hf_client_send_at_vts(char code) char *buf = osi_malloc(BTA_HF_CLIENT_AT_MAX_LEN); int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("vts"); return; } APPL_TRACE_DEBUG("%s", __FUNCTION__); at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+VTS=%c\r", code); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("vts", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_VTS, buf, at_len); osi_free(buf); } @@ -1801,12 +1889,19 @@ void bta_hf_client_send_at_binp(UINT32 action) int at_len; if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("binp"); return; } at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+BINP=%u\r", action); + at_len = MIN(at_len, BTA_HF_CLIENT_AT_MAX_LEN - 1); + if (at_len < 0) { + bta_hf_client_send_at_len_err_print("binp", at_len); + osi_free(buf); + return; + } + bta_hf_client_send_at(BTA_HF_CLIENT_AT_BINP, buf, at_len); osi_free(buf); } @@ -1825,7 +1920,7 @@ void bta_hf_client_send_at_bia(void) buf = osi_malloc(BTA_HF_CLIENT_AT_MAX_LEN); if (buf == NULL) { - APPL_TRACE_ERROR("No mem %s", __FUNCTION__); + bta_hf_client_send_at_nomem_err_print("bia"); return; } at_len = snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN, "AT+BIA="); @@ -1836,9 +1931,15 @@ void bta_hf_client_send_at_bia(void) at_len += snprintf(buf + at_len, BTA_HF_CLIENT_AT_MAX_LEN - at_len, "%d,", sup); } + at_len = (int)strnlen(buf, BTA_HF_CLIENT_AT_MAX_LEN); + if (at_len < 1) { + bta_hf_client_send_at_len_err_print("bia", at_len); + osi_free(buf); + return; + } buf[at_len - 1] = '\r'; - bta_hf_client_send_at(BTA_HF_CLIENT_AT_BIA, buf, at_len); + bta_hf_client_send_at(BTA_HF_CLIENT_AT_BIA, buf, (UINT16)at_len); osi_free(buf); } diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_cmd.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_cmd.c index 08e321d3511..b225e738df5 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_cmd.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_cmd.c @@ -37,10 +37,14 @@ void bta_hf_client_send_at_cmd(tBTA_HF_CLIENT_DATA *p_data) case BTA_HF_CLIENT_AT_CMD_CHUP: bta_hf_client_send_at_chup(); break; - case BTA_HF_CLIENT_AT_CMD_CHLD: - /* expects ascii code for command */ - bta_hf_client_send_at_chld('0' + p_val->uint32_val1, p_val->uint32_val2); + case BTA_HF_CLIENT_AT_CMD_CHLD: { + UINT32 chld_n = p_val->uint32_val1; + if (chld_n > 9) { + break; + } + bta_hf_client_send_at_chld((char)('0' + chld_n), p_val->uint32_val2); break; + } case BTA_HF_CLIENT_AT_CMD_BCC: bta_hf_client_send_at_bcc(); break; @@ -81,7 +85,7 @@ void bta_hf_client_send_at_cmd(tBTA_HF_CLIENT_DATA *p_data) bta_hf_client_send_at_xapl(p_val->str, p_val->uint32_val1); break; case BTA_HF_CLIENT_AT_CMD_IPHONEACCEV: - bta_hf_client_send_at_iphoneaccev(p_val->uint32_val1, p_val->uint32_val1 == 0 ? FALSE : TRUE); + bta_hf_client_send_at_iphoneaccev(p_val->uint32_val1, p_val->uint32_val2 == 0 ? FALSE : TRUE); break; default: APPL_TRACE_ERROR("Default case, %s", __FUNCTION__); diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_main.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_main.c index 9fdefa97f57..f8bf0f0ebbc 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_main.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_main.c @@ -302,7 +302,9 @@ void bta_hf_client_scb_disable(void) bta_hf_client_scb_init(); - (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_DISABLE_EVT, NULL); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(BTA_HF_CLIENT_DISABLE_EVT, NULL); + } } /******************************************************************************* @@ -405,6 +407,15 @@ void bta_hf_client_collision_cback (tBTA_SYS_CONN_STATUS status, UINT8 id, *******************************************************************************/ static void bta_hf_client_api_enable(tBTA_HF_CLIENT_DATA *p_data) { + if (bta_hf_client_cb.scb.p_disc_db != NULL) { + (void)SDP_CancelServiceSearch(bta_hf_client_cb.scb.p_disc_db); + bta_hf_client_free_db(NULL); + } + if (bta_hf_client_cb.scb.colli_tmr_on) { + bta_sys_stop_timer(&bta_hf_client_cb.scb.colli_timer); + bta_hf_client_cb.scb.colli_tmr_on = FALSE; + } + /* initialize control block */ memset(&bta_hf_client_cb, 0, sizeof(tBTA_HF_CLIENT_CB)); @@ -484,7 +495,6 @@ BOOLEAN bta_hf_client_hdl_event(BT_HDR *p_msg) case BTA_HF_CLIENT_API_DISABLE_EVT: bta_hf_client_api_disable((tBTA_HF_CLIENT_DATA *) p_msg); break; - default: bta_hf_client_sm_execute(p_msg->event, (tBTA_HF_CLIENT_DATA *) p_msg); break; diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_rfc.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_rfc.c index b64b6237027..2df87de4c56 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_rfc.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_rfc.c @@ -79,7 +79,9 @@ static void bta_hf_client_mgmt_cback(UINT32 code, UINT16 port_handle, void* data code, port_handle, bta_hf_client_cb.scb.conn_handle, bta_hf_client_cb.scb.serv_handle); /* ignore close event for port handles other than connected handle */ - if ((code != PORT_SUCCESS) && (port_handle != bta_hf_client_cb.scb.conn_handle)) { + if ((code != PORT_SUCCESS) && + (port_handle != bta_hf_client_cb.scb.conn_handle) && + (port_handle != bta_hf_client_cb.scb.serv_handle)) { APPL_TRACE_DEBUG("bta_hf_client_mgmt_cback ignoring handle:%d", port_handle); return; } @@ -206,6 +208,7 @@ void bta_hf_client_rfc_do_open(tBTA_HF_CLIENT_DATA *p_data) } /* RFCOMM create connection failed; send ourselves RFCOMM close event */ else { + bta_hf_client_cb.scb.conn_handle = 0; bta_hf_client_sm_execute(BTA_HF_CLIENT_RFC_CLOSE_EVT, p_data); } } diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_sco.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_sco.c index d464a889253..3be362090ca 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_sco.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_sco.c @@ -195,7 +195,9 @@ void bta_hf_client_cback_sco(UINT8 event) evt.sync_conn_handle = BTM_ReadScoHandle(bta_hf_client_cb.scb.sco_idx); /* call app cback */ - (*bta_hf_client_cb.p_cback)(event, (tBTA_HF_CLIENT_HDR *) &evt); + if (bta_hf_client_cb.p_cback) { + (*bta_hf_client_cb.p_cback)(event, (tBTA_HF_CLIENT_HDR *) &evt); + } } #if (BTM_SCO_HCI_INCLUDED == TRUE ) @@ -233,7 +235,7 @@ static void bta_hf_client_sco_read_cback (UINT16 sco_idx, BT_HDR *p_data, tBTM_S *******************************************************************************/ static void bta_hf_client_sco_conn_rsp(tBTM_ESCO_CONN_REQ_EVT_DATA *p_data) { - tBTM_ESCO_PARAMS resp; + tBTM_ESCO_PARAMS resp = {0}; UINT8 hci_status = HCI_SUCCESS; UINT8 index = BTA_HF_CLIENT_ESCO_PARAM_IDX_CVSD_S3; #if (BTM_SCO_HCI_INCLUDED == TRUE ) @@ -248,8 +250,8 @@ static void bta_hf_client_sco_conn_rsp(tBTM_ESCO_CONN_REQ_EVT_DATA *p_data) index = BTA_HF_CLIENT_SCO_PARAM_IDX_CVSD; } else { if ((bta_hf_client_cb.scb.negotiated_codec == BTM_SCO_CODEC_CVSD) && - (bta_hf_client_cb.scb.features && BTA_HF_CLIENT_FEAT_ESCO_S4) && - (bta_hf_client_cb.scb.peer_features && BTA_HF_CLIENT_PEER_ESCO_S4)) { + (bta_hf_client_cb.scb.features & BTA_HF_CLIENT_FEAT_ESCO_S4) && + (bta_hf_client_cb.scb.peer_features & BTA_HF_CLIENT_PEER_ESCO_S4)) { index = BTA_HF_CLIENT_ESCO_PARAM_IDX_CVSD_S4; #if BT_HF_CLIENT_BQB_INCLUDED if (s_bta_hf_client_bqb_esco_s1_flag == true) { @@ -307,7 +309,7 @@ void bta_hf_client_pkt_stat_nums(tBTA_HF_CLIENT_DATA *p_data) ** ** Function bta_hf_client_ci_sco_data ** -** Description Process the SCO data ready callin event +** Description Process the SCO data ready call in event ** ** ** Returns void @@ -460,8 +462,8 @@ static void bta_hf_client_sco_create(BOOLEAN is_orig) } if (bta_hf_client_cb.scb.negotiated_codec == BTM_SCO_CODEC_CVSD) { - if ((bta_hf_client_cb.scb.features && BTA_HF_CLIENT_FEAT_ESCO_S4) && - (bta_hf_client_cb.scb.peer_features && BTA_HF_CLIENT_PEER_ESCO_S4)) { + if ((bta_hf_client_cb.scb.features & BTA_HF_CLIENT_FEAT_ESCO_S4) && + (bta_hf_client_cb.scb.peer_features & BTA_HF_CLIENT_PEER_ESCO_S4)) { index = BTA_HF_CLIENT_ESCO_PARAM_IDX_CVSD_S4; } } else if (bta_hf_client_cb.scb.negotiated_codec == BTM_SCO_CODEC_MSBC) { From 8710d19ec3a5235227d0c3c48b81340159f3312b Mon Sep 17 00:00:00 2001 From: yangfeng Date: Wed, 25 Mar 2026 20:01:22 +0800 Subject: [PATCH 2/2] fix(bt): fix HFP api and btc component issues reported by AI review --- .../bt/host/bluedroid/api/esp_hf_ag_api.c | 60 ++++++++++++++++++- .../bt/host/bluedroid/api/esp_hf_client_api.c | 27 ++++++++- .../btc/profile/std/hf_ag/bta_ag_co.c | 11 ++-- .../btc/profile/std/hf_ag/btc_hf_ag.c | 34 ++++++----- .../profile/std/hf_client/bta_hf_client_co.c | 25 ++++---- .../btc/profile/std/hf_client/btc_hf_client.c | 6 +- 6 files changed, 125 insertions(+), 38 deletions(-) diff --git a/components/bt/host/bluedroid/api/esp_hf_ag_api.c b/components/bt/host/bluedroid/api/esp_hf_ag_api.c index 25e5b7bdcc9..e9286fadc8c 100644 --- a/components/bt/host/bluedroid/api/esp_hf_ag_api.c +++ b/components/bt/host/bluedroid/api/esp_hf_ag_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -77,6 +77,9 @@ esp_err_t esp_hf_ag_slc_connect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -96,6 +99,9 @@ esp_err_t esp_hf_ag_slc_disconnect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -115,6 +121,9 @@ esp_err_t esp_hf_ag_audio_connect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -134,6 +143,9 @@ esp_err_t esp_hf_ag_audio_disconnect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -153,6 +165,9 @@ esp_err_t esp_hf_ag_vra_control(esp_bd_addr_t remote_addr, esp_hf_vr_state_t val if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -161,7 +176,7 @@ esp_err_t esp_hf_ag_vra_control(esp_bd_addr_t remote_addr, esp_hf_vr_state_t val btc_hf_args_t arg; memset(&arg, 0, sizeof(btc_hf_args_t)); arg.vra_rep.value = value; - memcpy(&(arg.volcon.remote_addr), remote_addr, sizeof(esp_bd_addr_t)); + memcpy(&(arg.vra_rep.remote_addr), remote_addr, sizeof(esp_bd_addr_t)); /* Switch to BTC context */ bt_status_t status = btc_transfer_context(&msg, &arg, sizeof(btc_hf_args_t), NULL, NULL); @@ -173,6 +188,9 @@ esp_err_t esp_hf_ag_volume_control(esp_bd_addr_t remote_addr, esp_hf_volume_cont if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } if (volume < 0 || volume > 15) { return ESP_ERR_INVALID_ARG; } @@ -197,6 +215,9 @@ esp_err_t esp_hf_ag_unknown_at_send(esp_bd_addr_t remote_addr, char *unat) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL || unat == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -218,6 +239,9 @@ esp_err_t esp_hf_ag_cmee_send(esp_bd_addr_t remote_addr, esp_hf_at_response_code if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -268,6 +292,9 @@ esp_err_t esp_hf_ag_ciev_report(esp_bd_addr_t remote_addr, esp_hf_ciev_report_ty if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -293,6 +320,9 @@ esp_err_t esp_hf_ag_cind_response(esp_bd_addr_t remote_addr, if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } if (signal < 0 || signal > 5 || batt_lev < 0 || batt_lev > 5) { return ESP_ERR_INVALID_ARG; } @@ -323,6 +353,9 @@ esp_err_t esp_hf_ag_cops_response(esp_bd_addr_t remote_addr, char *name) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL || name == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -346,6 +379,9 @@ esp_err_t esp_hf_ag_clcc_response(esp_bd_addr_t remote_addr, int index, esp_hf_c if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -375,6 +411,9 @@ esp_err_t esp_hf_ag_cnum_response(esp_bd_addr_t remote_addr, char *number, int n if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } if (number == NULL || number_type < 128 || number_type > 175) { return ESP_ERR_INVALID_ARG; } @@ -385,7 +424,7 @@ esp_err_t esp_hf_ag_cnum_response(esp_bd_addr_t remote_addr, char *number, int n btc_hf_args_t arg; memset(&arg, 0, sizeof(btc_hf_args_t)); - memcpy(&(arg.cnum_rep), remote_addr, sizeof(esp_bd_addr_t)); + memcpy(&(arg.cnum_rep.remote_addr), remote_addr, sizeof(esp_bd_addr_t)); arg.cnum_rep.number = number; //deep_copy arg.cnum_rep.number_type = number_type; arg.cnum_rep.service_type = service_type; @@ -401,6 +440,9 @@ esp_err_t esp_hf_ag_bsir(esp_bd_addr_t remote_addr, esp_hf_in_band_ring_state_t if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -423,6 +465,9 @@ esp_err_t esp_hf_ag_answer_call(esp_bd_addr_t remote_addr, int num_active, int n if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -451,6 +496,9 @@ esp_err_t esp_hf_ag_reject_call(esp_bd_addr_t remote_addr, int num_active, int n if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -479,6 +527,9 @@ esp_err_t esp_hf_ag_end_call(esp_bd_addr_t remote_addr, int num_active, int num_ if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -507,6 +558,9 @@ esp_err_t esp_hf_ag_out_call(esp_bd_addr_t remote_addr, int num_active, int num_ if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; diff --git a/components/bt/host/bluedroid/api/esp_hf_client_api.c b/components/bt/host/bluedroid/api/esp_hf_client_api.c index f454acc09a3..e25c23363e2 100644 --- a/components/bt/host/bluedroid/api/esp_hf_client_api.c +++ b/components/bt/host/bluedroid/api/esp_hf_client_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -68,6 +68,9 @@ esp_err_t esp_hf_client_connect(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -90,6 +93,9 @@ esp_err_t esp_hf_client_disconnect(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -112,6 +118,9 @@ esp_err_t esp_hf_client_connect_audio(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -134,6 +143,9 @@ esp_err_t esp_hf_client_disconnect_audio(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -191,6 +203,9 @@ esp_err_t esp_hf_client_volume_update(esp_hf_volume_control_target_t type, int v if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (volume < 0 || volume > 15) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; btc_hf_client_args_t arg; @@ -391,6 +406,10 @@ esp_err_t esp_hf_client_send_dtmf(char code) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (!((code >= '0' && code <= '9') || code == '*' || code == '#' || + (code >= 'A' && code <= 'D'))) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; btc_hf_client_args_t arg; @@ -499,6 +518,9 @@ esp_err_t esp_hf_client_register_data_callback(esp_hf_client_incoming_data_cb_t if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (recv == NULL || send == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; @@ -553,6 +575,9 @@ esp_err_t esp_hf_client_pkt_stat_nums_get(uint16_t sync_conn_handle) void esp_hf_client_outgoing_data_ready(void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return; + } BTA_HfClientCiData(); } diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c index 6000f8324c2..d53599a9cb4 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c @@ -134,7 +134,7 @@ void bta_ag_ci_rx_write(UINT16 handle, char *p_data, UINT16 len) p_buf->hdr.event = BTA_AG_CI_RX_WRITE_EVT; p_buf->hdr.layer_specific = handle; p_data_area = (char *)(p_buf+1); /* Point to data area after header */ - strncpy(p_data_area, p_data, len); + memcpy(p_data_area, p_data, len); p_data_area[len] = 0; bta_sys_sendmsg(p_buf); } else { @@ -151,7 +151,7 @@ void bta_ag_ci_rx_write(UINT16 handle, char *p_data, UINT16 len) ** Function bta_ag_ci_slc_ready ** ** Description This function is called to notify AG that SLC is up at -** the application. This funcion is only used when the app +** the application. This function is only used when the app ** is running in pass-through mode. ** ** Returns void @@ -284,6 +284,7 @@ static void bta_ag_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN is_bad { bta_hf_ct_plc.first_good_frame_found = TRUE; sbc_plc_good_frame(&(bta_hf_ct_plc.plc_state), (int16_t *)bta_ag_co_cb.decode_raw_data, bta_hf_ct_plc.sbc_plc_out); + break; } case OI_CODEC_SBC_NOT_ENOUGH_HEADER_DATA: @@ -334,7 +335,7 @@ static void bta_ag_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN is_bad } /******************************************************************************* - * BTA AG SCO CO FUNCITONS + * BTA AG SCO CO FUNCTIONS ********************************************************************************/ /******************************************************************************* ** @@ -525,7 +526,7 @@ uint32_t bta_ag_sco_co_out_data(UINT8 *p_buf) //Never run to here. } } else { - APPL_TRACE_ERROR("%s invaild air mode: %d", __FUNCTION__, hf_air_mode); + APPL_TRACE_ERROR("%s invalid air mode: %d", __FUNCTION__, hf_air_mode); } return 0; } @@ -583,7 +584,7 @@ void bta_ag_sco_co_in_data(BT_HDR *p_buf, tBTM_SCO_DATA_FLAG status) //Never run to here. } } else { - APPL_TRACE_ERROR("%s invaild air mode: %d", __FUNCTION__, hf_air_mode); + APPL_TRACE_ERROR("%s invalid air mode: %d", __FUNCTION__, hf_air_mode); } } #endif /* #if (BTM_SCO_HCI_INCLUDED == TRUE) */ diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c index 66162261fd0..200549c2ab8 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -595,7 +595,7 @@ static bt_status_t btc_hf_cind_response(bt_bdaddr_t *bd_addr, if (is_connected(idx, bd_addr)) { tBTA_AG_RES_DATA ag_res; memset(&ag_res, 0, sizeof (ag_res)); - sprintf(ag_res.str, "%d,%d,%d,%d,%d,%d,%d", + snprintf(ag_res.str, sizeof(ag_res.str), "%d,%d,%d,%d,%d,%d,%d", call_status, /* Call state*/ call_setup_status, /* Callsetup state */ ntk_state, /* network service */ @@ -620,7 +620,7 @@ static bt_status_t btc_hf_cops_response(bt_bdaddr_t *bd_addr, const char *name) tBTA_AG_RES_DATA ag_res; memset (&ag_res, 0, sizeof (ag_res)); /* Format the response */ - sprintf(ag_res.str, "0,0,\"%s\"", name); + snprintf(ag_res.str, sizeof(ag_res.str), "0,0,\"%s\"", name); ag_res.ok_flag = BTA_AG_OK_DONE; BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_COPS_RES, &ag_res); return BT_STATUS_SUCCESS; @@ -645,12 +645,12 @@ static bt_status_t btc_hf_clcc_response(bt_bdaddr_t *bd_addr, int index, esp_hf_ } else { BTC_TRACE_EVENT("clcc_response: [%d] dir: %d current_call_state: %d mode: %d number: %s type: %d", index, dir, current_call_state, mode, number, type); - int loc = sprintf (ag_res.str, "%d,%d,%d,%d,%d", index, dir, current_call_state, mode, mpty); - if (number) { + int loc = snprintf(ag_res.str, sizeof(ag_res.str), "%d,%d,%d,%d,%d", index, dir, current_call_state, mode, mpty); + if (number && loc >= 0 && (size_t)loc < sizeof(ag_res.str)) { if ((type == ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL) && (*number != '+')) { - sprintf(&ag_res.str[loc], ",\"+%s\",%d", number, type); + snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",\"+%s\",%d", number, type); } else { - sprintf(&ag_res.str[loc], ",\"%s\",%d", number, type); + snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",\"%s\",%d", number, type); } } } @@ -671,9 +671,9 @@ static bt_status_t btc_hf_cnum_response(bt_bdaddr_t *bd_addr, const char *number memset(&ag_res, 0, sizeof (ag_res)); BTC_TRACE_EVENT("cnum_response: number = %s, number type = %d, service type = %d", number, number_type, service_type); if (service_type) { - sprintf(ag_res.str, ",\"%s\",%d,,%d",number, number_type, service_type); + snprintf(ag_res.str, sizeof(ag_res.str), ",\"%s\",%d,,%d", number, number_type, service_type); } else { - sprintf(ag_res.str, ",\"%s\",%d,,",number, number_type); + snprintf(ag_res.str, sizeof(ag_res.str), ",\"%s\",%d,,", number, number_type); } ag_res.ok_flag = BTA_AG_OK_DONE; BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_CNUM_RES, &ag_res); @@ -832,13 +832,13 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active if (number) { int loc = 0; if ((type == ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL) && (*number != '+')) { - loc = sprintf (ag_res.str, "\"+%s\"", number); + loc = snprintf(ag_res.str, sizeof(ag_res.str), "\"+%s\"", number); } else { - loc = sprintf (ag_res.str, "\"%s\"", number); + loc = snprintf(ag_res.str, sizeof(ag_res.str), "\"%s\"", number); } ag_res.num = type; - if (res == BTA_AG_CALL_WAIT_RES) { - sprintf(&ag_res.str[loc], ",%d", type); + if (res == BTA_AG_CALL_WAIT_RES && loc >= 0 && (size_t)loc < sizeof(ag_res.str)) { + snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",%d", type); } } break; @@ -1567,9 +1567,11 @@ void btc_hf_cb_handler(btc_msg_t *msg) memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t)); param.out_call.type = p_data->val.value; param.out_call.num_or_loc = osi_malloc((strlen(p_data->val.str) + 1) * sizeof(char)); - sprintf(param.out_call.num_or_loc, "%s", p_data->val.str); - btc_hf_cb_to_app(ESP_HF_DIAL_EVT, ¶m); - osi_free(param.out_call.num_or_loc); + if (param.out_call.num_or_loc) { + snprintf(param.out_call.num_or_loc, strlen(p_data->val.str) + 1, "%s", p_data->val.str); + btc_hf_cb_to_app(ESP_HF_DIAL_EVT, ¶m); + osi_free(param.out_call.num_or_loc); + } } else if (event == BTA_AG_AT_BLDN_EVT) { //dial_last memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t)); param.out_call.num_or_loc = NULL; diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c index 555e7137db7..8371cc63532 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -196,7 +196,7 @@ void bta_hf_client_sco_co_open(UINT16 handle, UINT8 air_mode, UINT8 inout_pkt_si #if (PLC_INCLUDED == TRUE) bta_hf_ct_plc_ptr = (bta_hf_ct_plc_t *)osi_calloc(sizeof(bta_hf_ct_plc_t)); - if (!bta_hf_ct_plc_ptr) { + if (!bta_hf_ct_plc_ptr) { APPL_TRACE_ERROR("%s malloc fail.", __FUNCTION__); goto error_exit; } @@ -249,12 +249,16 @@ void bta_hf_client_sco_co_close(void) if (hf_air_mode == BTM_SCO_AIR_MODE_TRANSPNT) { #if (PLC_INCLUDED == TRUE) +#if (HFP_DYNAMIC_MEMORY == TRUE) + if (bta_hf_ct_plc_ptr != NULL) { + sbc_plc_deinit(&(bta_hf_ct_plc.plc_state)); + bta_hf_ct_plc.first_good_frame_found = FALSE; + osi_free(bta_hf_ct_plc_ptr); + bta_hf_ct_plc_ptr = NULL; + } +#else sbc_plc_deinit(&(bta_hf_ct_plc.plc_state)); bta_hf_ct_plc.first_good_frame_found = FALSE; - -#if (HFP_DYNAMIC_MEMORY == TRUE) - osi_free(bta_hf_ct_plc_ptr); - bta_hf_ct_plc_ptr = NULL; #endif /// (HFP_DYNAMIC_MEMORY == TRUE) #endif ///(PLC_INCLUDED == TRUE) @@ -364,7 +368,7 @@ uint32_t bta_hf_client_sco_co_out_data(UINT8 *p_buf) } else { - APPL_TRACE_ERROR("%s invaild air mode: %d", __FUNCTION__, hf_air_mode); + APPL_TRACE_ERROR("%s invalid air mode: %d", __FUNCTION__, hf_air_mode); } return 0; } @@ -399,6 +403,7 @@ static void bta_hf_client_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN case OI_OK: bta_hf_ct_plc.first_good_frame_found = TRUE; sbc_plc_good_frame(&(bta_hf_ct_plc.plc_state), (int16_t *)bta_hf_client_co_cb.decode_raw_data, bta_hf_ct_plc.sbc_plc_out); + break; case OI_CODEC_SBC_NOT_ENOUGH_HEADER_DATA: case OI_CODEC_SBC_NOT_ENOUGH_BODY_DATA: case OI_CODEC_SBC_NOT_ENOUGH_AUDIO_DATA: @@ -432,11 +437,11 @@ static void bta_hf_client_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN APPL_TRACE_ERROR("Frame decode error: %d", status); break; } -#endif ///(PLC_INCLUDED == TRUE) - if (OI_SUCCESS(status)){ + if (OI_SUCCESS(status)) { btc_hf_client_incoming_data_cb_to_app((const uint8_t *)(bta_hf_ct_plc.sbc_plc_out), sbc_raw_data_size); } +#endif ///(PLC_INCLUDED == TRUE) } /******************************************************************************* @@ -496,7 +501,7 @@ void bta_hf_client_sco_co_in_data(BT_HDR *p_buf, tBTM_SCO_DATA_FLAG status) //Never run to here. } } else { - APPL_TRACE_ERROR("%s invaild air mode: %d", __FUNCTION__, hf_air_mode); + APPL_TRACE_ERROR("%s invalid air mode: %d", __FUNCTION__, hf_air_mode); } } diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c index e56c7a04b51..d0c7242890d 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -14,7 +14,6 @@ #include #include #include -#include #include "common/bt_defs.h" #include "device/bdaddr.h" #include "btc/btc_dm.h" @@ -517,6 +516,8 @@ static bt_status_t btc_hf_client_send_chld_cmd(esp_hf_chld_type_t type, int idx) } return BT_STATUS_UNSUPPORTED; + default: + return BT_STATUS_FAIL; } return BT_STATUS_SUCCESS; } @@ -1049,7 +1050,6 @@ void btc_hf_client_cb_handler(btc_msg_t *msg) param.cnum.type = ESP_HF_SUBSCRIBER_SERVICE_TYPE_UNKNOWN; } btc_hf_client_cb_to_app(ESP_HF_CLIENT_CNUM_EVT, ¶m); - break; } while (0); break; case BTA_HF_CLIENT_BTRH_EVT: