Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid

Browse Source
This commit is contained in:
Jin Cheng
2026-05-11 09:42:17 +08:00
committed by Jin Cheng
parent cb05dc0b3f
commit 945277cbc6
27 changed files with 434 additions and 241 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_sco.c
+43 -21
View File
@@ -24,7 +24,6 @@
******************************************************************************/
#include <string.h>
#include "stack/bt_types.h"
#include "common/bt_target.h"
#include "stack/bt_types.h"
#include "stack/hcimsgs.h"
@@ -405,10 +404,13 @@ static void btm_pkt_stat_nums_update(uint16_t sco_inx, uint8_t pkt_status)
*******************************************************************************/
static void btm_pkt_stat_send_nums_update(uint16_t sco_inx, uint8_t pkt_status)
{
tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
p_ccb->pkt_stat_nums.tx_total++;
if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) {
p_ccb->pkt_stat_nums.tx_discarded++;
tSCO_CONN *p_ccb = NULL;
if (sco_inx < BTM_MAX_SCO_LINKS) {
p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
p_ccb->pkt_stat_nums.tx_total++;
if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) {
p_ccb->pkt_stat_nums.tx_discarded++;
}
}
}
@@ -461,6 +463,7 @@ void btm_route_sco_data(BT_HDR *p_msg)
#if BTM_SCO_HCI_INCLUDED == TRUE
UINT16 sco_inx, handle;
UINT8 *p = (UINT8 *)(p_msg + 1) + p_msg->offset;
UINT16 len = p_msg->len;
UINT8 pkt_size = 0;
UINT8 pkt_status = 0;
@@ -470,12 +473,12 @@ void btm_route_sco_data(BT_HDR *p_msg)
handle = HCID_GET_HANDLE (handle);
STREAM_TO_UINT8 (pkt_size, p);
UNUSED(len);
UNUSED(pkt_size);
if ((sco_inx = btm_find_scb_by_handle(handle)) != BTM_MAX_SCO_LINKS ) {
/* send data callback */
if (!btm_cb.sco_cb.p_data_cb )
if (!btm_cb.sco_cb.p_data_cb) {
/* if no data callback registered, just free the buffer */
{
osi_free (p_msg);
} else {
btm_pkt_stat_nums_update(sco_inx, pkt_status);
@@ -484,7 +487,7 @@ void btm_route_sco_data(BT_HDR *p_msg)
} else { /* no mapping handle SCO connection is active, free the buffer */
osi_free (p_msg);
}
BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, p_msg->len, pkt_size);
BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, len, pkt_size);
#else
osi_free(p_msg);
#endif
@@ -516,12 +519,13 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
{
APPL_TRACE_DEBUG("%s", __FUNCTION__);
#if (BTM_SCO_HCI_INCLUDED == TRUE) && (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p_ccb = NULL;
UINT8 *p;
tBTM_STATUS status = BTM_SUCCESS;
if (sco_inx < BTM_MAX_SCO_LINKS && btm_cb.sco_cb.p_data_cb &&
p_ccb->state == SCO_ST_CONNECTED) {
btm_cb.sco_cb.sco_db[sco_inx].state == SCO_ST_CONNECTED) {
p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
/* Ensure we have enough space in the buffer for the SCO and HCI headers */
if (p_buf->offset < HCI_SCO_PREAMBLE_SIZE) {
BTM_TRACE_ERROR ("BTM SCO - cannot send buffer, offset: %d", p_buf->offset);
@@ -557,8 +561,12 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
}
}
} else {
BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]",
sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state);
if (sco_inx < BTM_MAX_SCO_LINKS) {
BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]",
sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state);
} else {
BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d", sco_inx);
}
status = BTM_UNKNOWN_ADDR;
}
@@ -566,7 +574,9 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
BTM_TRACE_WARNING ("stat %d", status);
osi_free(p_buf);
}
btm_pkt_stat_send_nums_update(sco_inx, status);
if (sco_inx < BTM_MAX_SCO_LINKS) {
btm_pkt_stat_send_nums_update(sco_inx, status);
}
return (status);
#else
@@ -722,8 +732,13 @@ void btm_accept_sco_link(UINT16 sco_inx, tBTM_ESCO_PARAMS *p_setup,
** Returns void
**
*******************************************************************************/
void btm_reject_sco_link( UINT16 sco_inx )
void btm_reject_sco_link( UINT16 sco_inx)
{
if (sco_inx >= BTM_MAX_SCO_LINKS) {
BTM_TRACE_ERROR("btm_reject_sco_link: Invalid sco_inx(%d)", sco_inx);
return;
}
btm_esco_conn_rsp(sco_inx, HCI_ERR_HOST_REJECT_RESOURCES,
btm_cb.sco_cb.sco_db[sco_inx].esco.data.bd_addr, NULL);
}
@@ -1373,10 +1388,12 @@ tBTM_STATUS BTM_SetScoPacketTypes (UINT16 sco_inx, UINT16 pkt_types)
UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx)
{
#if (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p = NULL;
/* Validity check */
if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) {
if ((sco_inx < BTM_MAX_SCO_LINKS) &&
((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) &&
(p->state == SCO_ST_CONNECTED)) {
return (p->esco.setup.packet_types);
} else {
return (0);
@@ -1425,10 +1442,12 @@ UINT16 BTM_ReadDeviceScoPacketTypes (void)
UINT16 BTM_ReadScoHandle (UINT16 sco_inx)
{
#if (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p = NULL;;
/* Validity check */
if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) {
if ((sco_inx < BTM_MAX_SCO_LINKS) &&
((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) &&
(p->state == SCO_ST_CONNECTED)) {
return (p->hci_handle);
} else {
return (BTM_INVALID_HCI_HANDLE);
@@ -1451,10 +1470,11 @@ UINT16 BTM_ReadScoHandle (UINT16 sco_inx)
UINT8 *BTM_ReadScoBdAddr (UINT16 sco_inx)
{
#if (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p = NULL;
/* Validity check */
if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->rem_bd_known)) {
if ((sco_inx < BTM_MAX_SCO_LINKS) &&
((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && (p->rem_bd_known)) {
return (p->esco.data.bd_addr);
} else {
return (NULL);
@@ -1538,7 +1558,9 @@ tBTM_STATUS BTM_RegForEScoEvts (UINT16 sco_inx, tBTM_ESCO_CBACK *p_esco_cback)
{
#if (BTM_MAX_SCO_LINKS>0)
if (!btm_cb.sco_cb.esco_supported) {
btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL;
if (sco_inx < BTM_MAX_SCO_LINKS) {
btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL;
}
return (BTM_MODE_UNSUPPORTED);
}
components/bt/host/bluedroid/stack/gap/gap_conn.c
+14 -10
View File
@@ -304,15 +304,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1
if (!p_ccb) {
return (GAP_ERR_BAD_HANDLE);
}
if (!p_len) {
return (GAP_ERR_ILL_PARM);
}
*p_len = 0;
osi_mutex_global_lock();
if (fixed_queue_is_empty(p_ccb->rx_queue)) {
osi_mutex_global_unlock();
return (GAP_NO_DATA_AVAIL);
}
osi_mutex_global_lock();
while (max_len) {
BT_HDR *p_buf = fixed_queue_try_peek_first(p_ccb->rx_queue);
if (p_buf == NULL) {
@@ -359,19 +363,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1
int GAP_GetRxQueueCnt (UINT16 handle, UINT32 *p_rx_queue_count)
{
tGAP_CCB *p_ccb;
int rc = BT_PASS;
int rc = GAP_INVALID_HANDLE;
if (!p_rx_queue_count) {
return GAP_ERR_ILL_PARM;
}
/* Check that handle is valid */
if (handle < GAP_MAX_CONNECTIONS) {
p_ccb = &gap_cb.conn.ccb_pool[handle];
p_ccb = gap_find_ccb_by_handle (handle);
if (p_ccb) {
if (p_ccb->con_state == GAP_CCB_STATE_CONNECTED) {
*p_rx_queue_count = p_ccb->rx_queue_size;
} else {
rc = GAP_INVALID_HANDLE;
rc = BT_PASS;
}
} else {
rc = GAP_INVALID_HANDLE;
}
GAP_TRACE_EVENT ("GAP_GetRxQueueCnt - rc = 0x%04x, rx_queue_count=%d",
components/bt/host/bluedroid/stack/l2cap/l2c_csm.c
+1 -2
View File
@@ -33,7 +33,6 @@
#include "l2c_int.h"
#include "btm_int.h"
#include "stack/btu.h"
#include "stack/hcimsgs.h"
#include "osi/allocator.h"
#if (L2CAP_COC_INCLUDED == TRUE)
@@ -121,7 +120,6 @@ void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
*******************************************************************************/
static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data;
UINT16 local_cid = p_ccb->local_cid;
tL2CA_DISCONNECT_IND_CB *disconnect_ind;
tL2CA_CONNECT_CFM_CB *connect_cfm;
@@ -168,6 +166,7 @@ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
break;
case L2CEVT_LP_CONNECT_CFM_NEG: /* Link failed */
tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data;
/* Disconnect unless ACL collision and upper layer wants to handle it */
if (p_ci->status != HCI_ERR_CONNECTION_EXISTS
|| !btm_acl_notif_conn_collision(p_ccb->p_lcb->remote_bd_addr)) {
components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c
+13 -13
View File
@@ -892,7 +892,7 @@ static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
/* If anything still waiting for ack, restart the timer if it was stopped */
if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q)) {
l2c_fcr_start_timer(p_ccb);
}
}
return (TRUE);
}
@@ -1342,7 +1342,7 @@ static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_wo
p_buf->len -= 2;
if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) {
L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_ccb->max_rx_mtu);
packet_ok = FALSE;
} else if ((p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL) {
L2CAP_TRACE_ERROR ("SAR - no buffer for SDU start user_rx_buf_size:%d", p_ccb->ertm_info.user_rx_buf_size);
@@ -1451,7 +1451,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
if (tx_seq == buf_seq) {
break;
}
}
}
}
@@ -1466,24 +1466,24 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
// the transmit data queue that satisfy the layer and event conditions.
for (const list_node_t *node = list_begin(p_ccb->p_lcb->link_xmit_data_q);
node != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
BT_HDR *p_buf = (BT_HDR *)list_node(node);
BT_HDR *p_node_buf = (BT_HDR *)list_node(node);
node = list_next(node);
/* Do not flush other CIDs or partial segments */
if ((p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid)) {
list_remove(p_ccb->p_lcb->link_xmit_data_q, p_buf);
osi_free(p_buf);
if ((p_node_buf->layer_specific == 0) && (p_node_buf->event == p_ccb->local_cid)) {
list_remove(p_ccb->p_lcb->link_xmit_data_q, p_node_buf);
osi_free(p_node_buf);
}
}
/* Also flush our retransmission queue */
while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q)) {
osi_free(fixed_queue_dequeue(p_ccb->fcrb.retrans_q, 0));
}
}
if (list_ack != NULL) {
node_ack = list_begin(list_ack);
}
}
}
if (list_ack != NULL) {
@@ -1502,7 +1502,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) ) {
break;
}
}
}
}
@@ -2150,11 +2150,11 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index]) {
p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
}
}
if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index]) {
p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
}
}
/* update sum, max and min of round trip delay of acking */
list_t *list = NULL;
@@ -2186,7 +2186,7 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
if ( delay < p_ccb->fcrb.ack_delay_min[index] ) {
p_ccb->fcrb.ack_delay_min[index] = delay;
}
}
}
}
}
components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c
+6 -1
View File
@@ -90,6 +90,12 @@ static void l2c_ucd_data_ind_cback (BD_ADDR rem_bda, BT_HDR *p_buf)
L2CAP_TRACE_DEBUG ("L2CAP - l2c_ucd_data_ind_cback");
if (p_buf->len < L2CAP_UCD_OVERHEAD) {
L2CAP_TRACE_ERROR ("L2CAP - data not enough for l2c_ucd_data_ind_cback %d", p_buf->len);
osi_free (p_buf);
return;
}
p = (UINT8 *)(p_buf + 1) + p_buf->offset;
STREAM_TO_UINT16(psm, p)
@@ -257,7 +263,6 @@ BOOLEAN L2CA_UcdDeregister_In_CCB_List (void *p_ccb_node, void * context)
BOOLEAN L2CA_UcdDeregister ( UINT16 psm )
{
tL2C_CCB *p_ccb;
tL2C_RCB *p_rcb;
UINT16 xx;
components/bt/host/bluedroid/stack/l2cap/l2cap_client.c
+7
View File
@@ -368,11 +368,18 @@ static void read_ready_cb(uint16_t local_channel_id, BT_HDR *packet)
l2cap_client_t *client = find(local_channel_id);
if (!client) {
L2CAP_TRACE_ERROR("%s unable to find L2CAP client matching LCID 0x%04x.\n", __func__, local_channel_id);
osi_free(packet);
return;
}
// TODO(sharvil): eliminate copy from BT_HDR.
buffer_t *buffer = buffer_new(packet->len);
if (!buffer) {
L2CAP_TRACE_ERROR("%s unable to new a buffer\n", __func__);
osi_free(packet);
return;
}
memcpy(buffer_ptr(buffer), packet->data + packet->offset, packet->len);
osi_free(packet);
components/bt/host/bluedroid/stack/sdp/sdp_api.c
+7 -5
View File
@@ -72,8 +72,8 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui
/* verify the parameters */
if (p_db == NULL || (sizeof (tSDP_DISCOVERY_DB) > len) ||
num_attr > SDP_MAX_ATTR_FILTERS || num_uuid > SDP_MAX_UUID_FILTERS) {
SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db 0x%x, len %d, num_uuid %d, num_attr %d",
(UINT32)p_db, len, num_uuid, num_attr);
SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db %p, len %d, num_uuid %d, num_attr %d",
p_db, len, num_uuid, num_attr);
return (FALSE);
}
@@ -99,8 +99,9 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui
sdpu_sort_attr_list( num_attr, p_db );
p_db->num_attr_filters = num_attr;
#endif
return (TRUE);
#endif
return (FALSE);
}
@@ -124,8 +125,9 @@ BOOLEAN SDP_CancelServiceSearch (tSDP_DISCOVERY_DB *p_db)
sdp_disconnect (p_ccb, SDP_CANCEL);
p_ccb->disc_state = SDP_DISC_WAIT_CANCEL;
#endif
return (TRUE);
#endif
return (FALSE);
}
@@ -429,7 +431,7 @@ BOOLEAN SDP_FindServiceUUIDInRec_128bit(tSDP_DISC_REC *p_rec, tBT_UUID *p_uuid)
for (p_sattr = p_attr->attr_value.v.p_sub_attr; p_sattr; p_sattr = p_sattr->p_next_attr) {
if (SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UUID_DESC_TYPE) {
/* only support 128 bits UUID for now */
if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 16) {
if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == LEN_UUID_128) {
p_uuid->len = LEN_UUID_128;
for (uint8_t i = 0; i != LEN_UUID_128; ++i) {
p_uuid->uu.uuid128[i] = p_sattr->attr_value.v.array[LEN_UUID_128 - i - 1];
components/bt/host/bluedroid/stack/sdp/sdp_db.c
+13 -14
View File
@@ -68,15 +68,15 @@ tSDP_RECORD *sdp_db_service_search (tSDP_RECORD *p_rec, tSDP_UUID_SEQ *p_seq)
/* If NULL, start at the beginning, else start at the first specified record */
if (!p_rec) {
p_node = list_begin(sdp_cb.server_db.p_record_list);
p_node = list_begin(sdp_cb.server_db.p_record_list);
} else {
/* get node in the record list with given p_rec */
/* get node in the record list with given p_rec */
p_node = list_get_node(sdp_cb.server_db.p_record_list, p_rec);
if (p_node == NULL) {
return NULL;
}
/* get next node */
p_node = list_next(p_node);
if (p_node == NULL) {
return NULL;
}
/* get next node */
p_node = list_next(p_node);
}
/* Look through the records. The spec says that a match occurs if */
@@ -178,8 +178,8 @@ tSDP_RECORD *sdp_db_find_record (UINT32 handle)
/* Look through the records for the caller's handle */
for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
p_rec = list_node(p_node);
if (p_rec->record_handle == handle) {
p_rec = list_node(p_node);
if (p_rec->record_handle == handle) {
return (p_rec);
}
}
@@ -446,7 +446,7 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type,
/* Find the record in the database */
for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
p_rec= list_node(p_node);
p_rec= list_node(p_node);
if (p_rec->record_handle == handle) {
tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0];
@@ -498,13 +498,12 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type,
}
}
if ((attr_len > 0) && (p_val != 0)) {
if (attr_len > 0) {
p_attr->len = attr_len;
memcpy (&p_rec->attr_pad[p_rec->free_pad_ptr], p_val, (size_t)attr_len);
p_attr->value_ptr = &p_rec->attr_pad[p_rec->free_pad_ptr];
p_rec->free_pad_ptr += attr_len;
} else if ((attr_len == 0 && p_attr->len != 0) || /* if truncate to 0 length, simply don't add */
p_val == 0) {
} else if (attr_len == 0 && p_attr->len != 0) { /* if truncate to 0 length, simply don't add */
SDP_TRACE_ERROR("SDP_AddAttribute fail, length exceed maximum: ID %d: attr_len:%d \n",
attr_id, attr_len );
p_attr->id = p_attr->type = p_attr->len = 0;
@@ -889,7 +888,7 @@ BOOLEAN SDP_DeleteAttribute (UINT32 handle, UINT16 attr_id)
/* Find the record in the database */
for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
p_rec= list_node(p_node);
p_rec= list_node(p_node);
if (p_rec->record_handle == handle) {
tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0];
components/bt/host/bluedroid/stack/sdp/sdp_discovery.c
+7 -3
View File
@@ -90,7 +90,7 @@ static UINT8 *sdpu_build_uuid_seq (UINT8 *p_out, UINT16 num_uuids, tSDP_UUID *p_
UINT32_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid32);
} else {
UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES);
ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, p_uuid_list->len);
ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, LEN_UUID_128);
}
}
@@ -374,6 +374,10 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
p = &p_ccb->rsp_list[0];
p_end = &p_ccb->rsp_list[0] + list_len;
if (cpy_len == 0) {
return;
}
if (offset) {
type = *p++;
cpy_len--;
@@ -835,7 +839,7 @@ static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end)
** Returns pointer to next byte in data stream
**
*******************************************************************************/
tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda)
static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda)
{
tSDP_DISC_REC *p_rec;
@@ -950,7 +954,7 @@ static UINT8 *add_attr (UINT8 *p, UINT8 *p_end, tSDP_DISCOVERY_DB *p_db, tSDP_DI
break;
}
}
/* Case falls through */
/* falls through */
case TWO_COMP_INT_DESC_TYPE:
switch (attr_len) {
components/bt/host/bluedroid/stack/sdp/sdp_main.c
+9 -4
View File
@@ -28,7 +28,6 @@
#include "common/bt_target.h"
#include "osi/allocator.h"
#include "stack/l2cdefs.h"
#include "stack/hcidefs.h"
#include "stack/hcimsgs.h"
@@ -138,6 +137,10 @@ void sdp_init (void)
{
#if SDP_DYNAMIC_MEMORY
sdp_cb_ptr = (tSDP_CB *)osi_malloc(sizeof(tSDP_CB));
if (!sdp_cb_ptr) {
ESP_LOGE("BT_SDP", "SDP control block malloc failed\n");
return;
}
#endif /* #if SDP_DYNAMIC_MEMORY */
/* Clears all structures and local SDP database (if Server is enabled) */
memset (&sdp_cb, 0, sizeof (tSDP_CB));
@@ -208,8 +211,10 @@ void sdp_deinit (void)
{
list_free(sdp_cb.server_db.p_record_list);
#if SDP_DYNAMIC_MEMORY
osi_free(sdp_cb_ptr);
sdp_cb_ptr = NULL;
if (sdp_cb_ptr) {
osi_free(sdp_cb_ptr);
sdp_cb_ptr = NULL;
}
#endif /* #if SDP_DYNAMIC_MEMORY */
}
@@ -403,7 +408,7 @@ static void sdp_config_ind (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg)
p_cfg->mtu_present = FALSE;
p_cfg->result = L2CAP_CFG_OK;
/* Check peer config request against our rfcomm configuration */
/* Check peer config request against our sdp configuration */
if (p_cfg->fcr_present) {
/* Reject the window size if it is bigger than we want it to be */
if (p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE) {
components/bt/host/bluedroid/stack/sdp/sdp_server.c
+54 -9
View File
@@ -344,13 +344,18 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;
}
p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq);
p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq);
if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST);
return;
}
if (max_list_len < 4) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);
return;
}
memcpy(&attr_seq_sav, &attr_seq, sizeof(tSDP_ATTR_SEQ)) ;
/* Find a record with the record handle */
@@ -375,31 +380,32 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
p_ccb->rsp_list = (UINT8 *)osi_malloc(max_list_len);
if (p_ccb->rsp_list == NULL) {
SDP_TRACE_ERROR("%s No scratch buf for attr rsp\n", __func__);
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
return;
}
if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
BE_STREAM_TO_UINT16 (cont_offset, p_req);
if (cont_offset != p_ccb->cont_offset) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
if (!p_ccb->rsp_list) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
return;
}
is_cont = TRUE;
/* Initialise for continuation response */
p_rsp = &p_ccb->rsp_list[0];
attr_seq.attr_entry[p_ccb->cont_info.next_attr_index].start = p_ccb->cont_info.next_attr_start_id;
} else {
if (p_ccb->rsp_list) {
if (p_ccb->rsp_list) {
osi_free (p_ccb->rsp_list);
}
@@ -438,6 +444,12 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (p_ccb->cont_info.attr_offset) {
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* If the partial attrib could not been fully added yet */
if (p_ccb->cont_info.attr_offset != attr_len) {
@@ -449,12 +461,20 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (attr_len >= SDP_MAX_ATTR_LEN) {
SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len);
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* add the partial attribute if possible */
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_ccb->cont_info.next_attr_index = xx;
p_ccb->cont_info.next_attr_start_id = p_attr->id;
@@ -502,6 +522,8 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
/* Get a buffer to use to build the response */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_buf->offset = L2CAP_MIN_OFFSET;
@@ -574,7 +596,6 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
BOOLEAN maxxed_out = FALSE, is_cont = FALSE;
UINT8 *p_seq_start;
UINT16 seq_len, attr_len;
UNUSED(p_req_end);
/* Extract the UUID sequence to search for */
p_req = sdpu_extract_uid_seq (p_req, param_len, &uid_seq);
@@ -591,9 +612,9 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
max_list_len = p_ccb->rem_mtu_size - SDP_MAX_SERVATTR_RSPHDR_LEN;
}
p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq);
p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq);
if ((!p_req) || (!attr_seq.num_attr)) {
if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST);
return;
}
@@ -625,17 +646,23 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN);
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
BE_STREAM_TO_UINT16 (cont_offset, p_req);
if (cont_offset != p_ccb->cont_offset) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX);
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
if (!p_ccb->rsp_list) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
is_cont = TRUE;
@@ -704,6 +731,12 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (p_ccb->cont_info.attr_offset) {
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* If the partial attrib could not been fully added yet */
if (p_ccb->cont_info.attr_offset != attr_len) {
@@ -716,12 +749,20 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (attr_len >= SDP_MAX_ATTR_LEN) {
SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len);
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* add the partial attribute if possible */
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_ccb->cont_info.next_attr_index = xx;
p_ccb->cont_info.next_attr_start_id = p_attr->id;
@@ -791,6 +832,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
// TODO(sharvil): rewrite SDP server.
if (is_cont && len_to_send == 0) {
sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
@@ -817,6 +860,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
/* Get a buffer to use to build the response */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_buf->offset = L2CAP_MIN_OFFSET;
components/bt/host/bluedroid/stack/sdp/sdp_utils.c
+99 -26
View File
@@ -361,6 +361,8 @@ void sdpu_build_n_send_error (tCONN_CB *p_ccb, UINT16 trans_num, UINT16 error_co
UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
{
UINT8 *p_seq_end;
UINT8 *p_param_start;
UINT8 *p_param_end;
UINT8 descr, type, size;
UINT32 seq_len, uuid_len;
@@ -368,7 +370,12 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
p_seq->num_uids = 0;
/* A UID sequence is composed of a bunch of UIDs. */
p_param_start = p;
p_param_end = p_param_start + param_len;
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -388,26 +395,38 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
seq_len = 16;
break;
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (seq_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT16 (seq_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT32 (seq_len, p);
break;
default:
return (NULL);
}
if (seq_len >= param_len) {
p_seq_end = p + seq_len;
if (p_seq_end < p || p_seq_end > p_param_end) {
return (NULL);
}
p_seq_end = p + seq_len;
/* Loop through, extracting the UIDs */
for ( ; p < p_seq_end ; ) {
if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -427,31 +446,37 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
uuid_len = 16;
break;
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_seq_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (uuid_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_seq_end) {
return (NULL);
}
BE_STREAM_TO_UINT16 (uuid_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_seq_end) {
return (NULL);
}
BE_STREAM_TO_UINT32 (uuid_len, p);
break;
default:
return (NULL);
}
/* If UUID length is valid, copy it across */
if ((uuid_len == 2) || (uuid_len == 4) || (uuid_len == 16)) {
p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len;
BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len);
p_seq->num_uids++;
} else {
if ((uuid_len != 2) && (uuid_len != 4) && (uuid_len != 16)) {
return (NULL);
}
if (p + uuid_len > p_seq_end) {
return (NULL);
}
/* We can only do so many */
if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) {
return (NULL);
}
p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len;
BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len);
p_seq->num_uids++;
}
if (p != p_seq_end) {
@@ -476,13 +501,22 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
{
UINT8 *p_end_list;
UINT8 *p_param_start;
UINT8 *p_param_end;
UINT8 descr, type, size;
UINT32 list_len, attr_len;
/* Assume none found */
p_seq->num_attr = 0;
/* param_len is bytes available from p through end of SDP parameter block */
p_param_start = p;
p_param_end = p_param_start + param_len;
/* Get attribute sequence info */
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -493,14 +527,23 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
switch (size) {
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (list_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT16 (list_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT32 (list_len, p);
break;
@@ -508,14 +551,17 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
return (p);
}
if (list_len > param_len) {
return (p);
}
p_end_list = p + list_len;
if (p_end_list < p || p_end_list > p_param_end) {
return (NULL);
}
/* Loop through, extracting the attribute IDs */
for ( ; p < p_end_list ; ) {
if (p_seq->num_attr >= MAX_ATTR_PER_SEQ) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -532,34 +578,45 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
attr_len = 4;
break;
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT8 (attr_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT16 (attr_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT32 (attr_len, p);
break;
default:
return (NULL);
break;
}
/* Attribute length must be 2-bytes or 4-bytes for a paired entry. */
if (attr_len == 2) {
if (p + 2 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p);
p_seq->attr_entry[p_seq->num_attr].end = p_seq->attr_entry[p_seq->num_attr].start;
} else if (attr_len == 4) {
if (p + 4 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p);
BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].end, p);
} else {
return (NULL);
}
/* We can only do so many */
if (++p_seq->num_attr >= MAX_ATTR_PER_SEQ) {
return (NULL);
}
p_seq->num_attr++;
}
return (p);
@@ -995,6 +1052,25 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI
UINT8 *p_tmp_attr;
size_t len_to_copy;
UINT16 attr_len;
UINT16 rem_in_attr;
attr_len = sdpu_get_attrib_entry_len(p_attr);
if (attr_len > SDP_MAX_ATTR_LEN) {
SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: attr_len %u exceeds SDP_MAX_ATTR_LEN %u\n",
attr_len, (UINT16)SDP_MAX_ATTR_LEN);
return NULL;
}
if (*offset > attr_len) {
SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: offset %u past attr_len %u\n", *offset, attr_len);
return NULL;
}
rem_in_attr = (UINT16)(attr_len - *offset);
len_to_copy = (size_t)((rem_in_attr < len) ? rem_in_attr : len);
/* rem_in_attr is 0 when *offset == attr_len; avoid memcpy(0) issues and useless work */
if (len_to_copy == 0) {
return p_out;
}
if ((p_attr_buff = (UINT8 *) osi_malloc(sizeof(UINT8) * SDP_MAX_ATTR_LEN )) == NULL) {
SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry cannot get a buffer!\n");
@@ -1003,14 +1079,11 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI
p_tmp_attr = p_attr_buff;
sdpu_build_attrib_entry(p_tmp_attr, p_attr);
attr_len = sdpu_get_attrib_entry_len(p_attr);
len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset) : len;
memcpy(p_out, &p_attr_buff[*offset], len_to_copy);
p_out = &p_out[len_to_copy];
*offset += len_to_copy;
*offset += (UINT16)len_to_copy;
osi_free(p_attr_buff);
return p_out;
components/bt/host/bluedroid/stack/smp/smp_br_main.c
+8 -2
View File
@@ -37,7 +37,7 @@ const char *const smp_br_event_name [SMP_BR_MAX_EVT] = {
"BR_CONFIRM_EVT",
"BR_RAND_EVT",
"BR_PAIRING_FAILED_EVT",
"BR_ENCRPTION_INFO_EVT",
"BR_ENCRYPTION_INFO_EVT",
"BR_MASTER_ID_EVT",
"BR_ID_INFO_EVT",
"BR_ID_ADDR_EVT",
@@ -316,7 +316,13 @@ void smp_br_state_machine_event(tSMP_CB *p_cb, tSMP_BR_EVENT event, void *p_data
tSMP_BR_STATE curr_state = p_cb->br_state;
tSMP_BR_SM_TBL state_table;
UINT8 action, entry;
tSMP_BR_ENTRY_TBL entry_table = smp_br_entry_table[p_cb->role];
tSMP_BR_ENTRY_TBL entry_table = NULL;
if (p_cb->role > HCI_ROLE_SLAVE) {
SMP_TRACE_ERROR("Invalid role: %d", p_cb->role);
return;
}
entry_table = smp_br_entry_table[p_cb->role];
SMP_TRACE_EVENT("main %s", __func__);
if (curr_state >= SMP_BR_STATE_MAX) {