Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt_sdp): size SDP TX buffers

Browse Source
This commit is contained in:
hejiaxin
2026-08-27 15:11:44 +08:00
parent 53200e1ec4
commit 8a0156c4ed
3 changed files with 34 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/sdp/sdp_discovery.c
+14 -3
View File
@@ -56,6 +56,17 @@ static UINT8 *add_attr (UINT8 *p, UINT8 *p_end, tSDP_DISCOVERY_DB *p_db,
/* Safety check in case we go crazy */ /* Safety check in case we go crazy */
#define MAX_NEST_LEVELS 5 #define MAX_NEST_LEVELS 5
/* Worst case length of any SDP request built by this module:
* pdu id(1) + transaction id(2) + parameter length(2)
* + UUID sequence: 2 byte header + SDP_MAX_UUID_FILTERS 128-bit UUIDs
* + maximum record/byte count(2)
* + attribute sequence: 3 byte header + SDP_MAX_ATTR_FILTERS entries of 3 bytes
* + continuation state: 1 byte length + SDP_MAX_CONTINUATION_LEN(16)
* A service attribute request carries a 4 byte record handle instead of the UUID
* sequence, so it is covered as well. */
#define SDP_MAX_REQ_LEN (5 + (2 + SDP_MAX_UUID_FILTERS * (1 + LEN_UUID_128)) + 2 \
+ (3 + SDP_MAX_ATTR_FILTERS * 3) + (1 + SDP_MAX_CONTINUATION_LEN))
/******************************************************************************* /*******************************************************************************
** **
@@ -117,7 +128,7 @@ static void sdp_snd_service_search_req(tCONN_CB *p_ccb, UINT8 cont_len, UINT8 *p
UINT16 param_len; UINT16 param_len;
/* Get a buffer to send the packet to L2CAP */ /* Get a buffer to send the packet to L2CAP */
if ((p_cmd = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { if ((p_cmd = (BT_HDR *) osi_malloc(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + SDP_MAX_REQ_LEN)) == NULL) {
sdp_disconnect (p_ccb, SDP_NO_RESOURCES); sdp_disconnect (p_ccb, SDP_NO_RESOURCES);
return; return;
} }
@@ -507,7 +518,7 @@ static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT8 *p_
/* Now, ask for the next handle. Reuse the buffer we just got. */ /* Now, ask for the next handle. Reuse the buffer we just got. */
if (p_ccb->cur_handle < p_ccb->num_handles) { if (p_ccb->cur_handle < p_ccb->num_handles) {
BT_HDR *p_msg = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE); BT_HDR *p_msg = (BT_HDR *) osi_malloc(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + SDP_MAX_REQ_LEN);
UINT8 *p; UINT8 *p;
if (!p_msg) { if (!p_msg) {
@@ -656,7 +667,7 @@ static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UI
#endif #endif
/* If continuation request (or first time request) */ /* If continuation request (or first time request) */
if ((cont_request_needed) || (!p_reply)) { if ((cont_request_needed) || (!p_reply)) {
BT_HDR *p_msg = (BT_HDR *) osi_malloc(SDP_DATA_BUF_SIZE); BT_HDR *p_msg = (BT_HDR *) osi_malloc(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + SDP_MAX_REQ_LEN);
UINT8 *p; UINT8 *p;
if (!p_msg) { if (!p_msg) {
components/bt/host/bluedroid/stack/sdp/sdp_server.c
+6 -6
View File
@@ -256,8 +256,8 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num,
is_cont = TRUE; is_cont = TRUE;
} }
/* Get a buffer to use to build the response */ /* Get a buffer to use to build the response, the whole PDU has to fit the peer MTU */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + p_ccb->rem_mtu_size)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
return; return;
} }
@@ -523,8 +523,8 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
} }
} }
/* Get a buffer to use to build the response */ /* Get a buffer to use to build the response, the whole PDU has to fit the peer MTU */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + p_ccb->rem_mtu_size)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
osi_free(p_ccb->rsp_list); osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL; p_ccb->rsp_list = NULL;
@@ -865,8 +865,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
} }
} }
/* Get a buffer to use to build the response */ /* Get a buffer to use to build the response, the whole PDU has to fit the peer MTU */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + L2CAP_MIN_OFFSET + p_ccb->rem_mtu_size)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
osi_free (p_ccb->rsp_list); osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL; p_ccb->rsp_list = NULL;
components/bt/host/bluedroid/stack/sdp/sdp_utils.c
+14 -1
View File
@@ -306,14 +306,27 @@ void sdpu_build_n_send_error (tCONN_CB *p_ccb, UINT16 trans_num, UINT16 error_co
{ {
UINT8 *p_rsp, *p_rsp_start, *p_rsp_param_len; UINT8 *p_rsp, *p_rsp_start, *p_rsp_param_len;
UINT16 rsp_param_len; UINT16 rsp_param_len;
UINT16 buf_size;
BT_HDR *p_buf; BT_HDR *p_buf;
UINT16 len;
SDP_TRACE_WARNING ("SDP - sdpu_build_n_send_error code: 0x%x CID: 0x%x\n", SDP_TRACE_WARNING ("SDP - sdpu_build_n_send_error code: 0x%x CID: 0x%x\n",
error_code, p_ccb->connection_id); error_code, p_ccb->connection_id);
/* pdu id(1), trans num(2), param len(2), error code(2) and the optional error text */
buf_size = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + 7;
if (p_error_text) {
len = (UINT16)strlen(p_error_text);
if (len > SDP_DATA_BUF_SIZE - buf_size) {
buf_size = SDP_DATA_BUF_SIZE;
}else {
buf_size += len;
}
}
/* Get a buffer to use to build and send the packet to L2CAP */ /* Get a buffer to use to build and send the packet to L2CAP */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { if ((p_buf = (BT_HDR *)osi_malloc(buf_size)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for err msg\n"); SDP_TRACE_ERROR ("SDP - no buf for err msg\n");
return; return;
} }