From a2739c9ee1509854229a587db7bc241640ff24fa Mon Sep 17 00:00:00 2001
From: Shreeyash Bhakare <shreeyash.bhakare@espressif.com>
Date: Thu, 11 Jun 2026 17:02:24 +0530
Subject: [PATCH] fix(nimble): Added security related fixes

---
 components/bt/host/nimble/nimble                    |  2 +-
 components/protocomm/src/simple_ble/simple_ble.c    | 11 +++++------
 components/protocomm/src/transports/protocomm_ble.c |  8 +++++++-
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 655895824d8..843673ada2e 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 655895824d89e78e1bfdd5d38bcb6326bc1fe06b
+Subproject commit 843673ada2e33301376edc373f96b17460244fc1
diff --git a/components/protocomm/src/simple_ble/simple_ble.c b/components/protocomm/src/simple_ble/simple_ble.c
index b1a9fdcbfd6..1d77493a3bc 100644
--- a/components/protocomm/src/simple_ble/simple_ble.c
+++ b/components/protocomm/src/simple_ble/simple_ble.c
@@ -159,17 +159,17 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_
         adv_config_done |= scan_rsp_config_flag;
         break;
     case ESP_GATTS_READ_EVT:
-        if (g_ble_cfg_p) {
+        if (g_ble_cfg_p && g_ble_cfg_p->read_fn) {
             g_ble_cfg_p->read_fn(event, gatts_if, param);
         }
         break;
     case ESP_GATTS_WRITE_EVT:
-        if (g_ble_cfg_p) {
+        if (g_ble_cfg_p && g_ble_cfg_p->write_fn) {
             g_ble_cfg_p->write_fn(event, gatts_if, param);
         }
         break;
     case ESP_GATTS_EXEC_WRITE_EVT:
-        if (g_ble_cfg_p) {
+        if (g_ble_cfg_p && g_ble_cfg_p->exec_write_fn) {
             g_ble_cfg_p->exec_write_fn(event, gatts_if, param);
         }
         break;
@@ -187,7 +187,7 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_
         break;
     case ESP_GATTS_CONNECT_EVT:
         ESP_LOGD(TAG, "ESP_GATTS_CONNECT_EVT, conn_id = %d", param->connect.conn_id);
-        if (g_ble_cfg_p) {
+        if (g_ble_cfg_p && g_ble_cfg_p->connect_fn) {
             g_ble_cfg_p->connect_fn(event, gatts_if, param);
         }
         esp_ble_conn_update_params_t conn_params = {0};
@@ -202,7 +202,7 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_
         break;
     case ESP_GATTS_DISCONNECT_EVT:
         ESP_LOGD(TAG, "ESP_GATTS_DISCONNECT_EVT, reason = %d", param->disconnect.reason);
-        if (g_ble_cfg_p) {
+        if (g_ble_cfg_p && g_ble_cfg_p->disconnect_fn) {
             g_ble_cfg_p->disconnect_fn(event, gatts_if, param);
         }
         memset(s_cached_remote_bda, 0, sizeof(esp_bd_addr_t));
@@ -263,7 +263,6 @@ esp_err_t simple_ble_deinit(void)
     simple_ble_cfg_t *ble_cfg = g_ble_cfg_p;
     g_ble_cfg_p = NULL;
     if (ble_cfg) {
-        free(ble_cfg->gatt_db);
         ble_cfg->gatt_db = NULL;
         free(ble_cfg);
     }
diff --git a/components/protocomm/src/transports/protocomm_ble.c b/components/protocomm/src/transports/protocomm_ble.c
index a64fd1d84a8..179c38c679c 100644
--- a/components/protocomm/src/transports/protocomm_ble.c
+++ b/components/protocomm/src/transports/protocomm_ble.c
@@ -74,6 +74,7 @@ typedef struct _protocomm_ble {
 } _protocomm_ble_internal_t;
 
 static _protocomm_ble_internal_t *protoble_internal;
+static esp_gatts_attr_db_t *s_gatt_db;
 
 static bool protocomm_ble_transport_active(void)
 {
@@ -715,6 +716,8 @@ static ssize_t populate_gatt_db(esp_gatts_attr_db_t **gatt_db_generated)
 static void protocomm_ble_cleanup(void)
 {
     protocomm_ble_reset_prepare_write();
+    free(s_gatt_db);
+    s_gatt_db = NULL;
     if (protoble_internal) {
         if (protoble_internal->service_uuid) {
             free(protoble_internal->service_uuid);
@@ -891,6 +894,7 @@ esp_err_t protocomm_ble_start(protocomm_t *pc, const protocomm_ble_config_t *con
 
     ble_config->device_name     = protocomm_ble_device_name;
     ble_config->gatt_db_count   = populate_gatt_db(&ble_config->gatt_db);
+    s_gatt_db = ble_config->gatt_db;
 
     ble_config->ble_bonding = config->ble_bonding;
     ble_config->ble_sm_sc   = config->ble_sm_sc;
@@ -904,7 +908,9 @@ esp_err_t protocomm_ble_start(protocomm_t *pc, const protocomm_ble_config_t *con
 
     if (ble_config->gatt_db_count == -1) {
         ESP_LOGE(TAG, "Invalid GATT database count");
-        free(ble_config->gatt_db);
+        free(s_gatt_db);
+        s_gatt_db = NULL;
+        ble_config->gatt_db = NULL;
         free(ble_config);
         protocomm_ble_cleanup();
         return ESP_ERR_INVALID_STATE;