Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/bug_bounty_av_v6.0' into 'release/v6.0'

Browse Source 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v6.0)

See merge request espressif/esp-idf!50477
This commit is contained in:
Jiang Jiang Jian
2026-07-20 13:54:41 +08:00
parent 3befd9d774 e472bc3868
commit a2cd919a64
3 changed files with 36 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/bt/host/bluedroid/stack/avct/avct_ccb.c
View File

@@ -92,7 +92,9 @@ void avct_ccb_dealloc(tAVCT_CCB *p_ccb, UINT8 event, UINT16 result, BD_ADDR bd_a
#endif
if (event != AVCT_NO_EVT) {
(*p_cback)(avct_ccb_to_idx(p_ccb), event, result, bd_addr);
if (p_cback) {
(*p_cback)(avct_ccb_to_idx(p_ccb), event, result, bd_addr);
}
}
}

41
components/bt/host/bluedroid/stack/avct/avct_lcb_act.c
View File

@@ -251,8 +251,10 @@ void avct_lcb_open_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
if (p_ccb->p_lcb == p_lcb) {
bind = TRUE;
L2CA_SetTxPriority(p_lcb->ch_lcid, L2CAP_CHNL_PRIORITY_HIGH);
p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_CFM_EVT,
0, p_lcb->peer_addr);
if (p_ccb->cc.p_ctrl_cback) {
p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_CFM_EVT,
0, p_lcb->peer_addr);
}
}
/* if unbound acceptor and lcb doesn't already have a ccb for this PID */
else if ((p_ccb->p_lcb == NULL) && (p_ccb->cc.role == AVCT_ACP) &&
@@ -261,8 +263,10 @@ void avct_lcb_open_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
bind = TRUE;
p_ccb->p_lcb = p_lcb;
L2CA_SetTxPriority(p_lcb->ch_lcid, L2CAP_CHNL_PRIORITY_HIGH);
p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_IND_EVT,
0, p_lcb->peer_addr);
if (p_ccb->cc.p_ctrl_cback) {
p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_IND_EVT,
0, p_lcb->peer_addr);
}
}
}
}
@@ -321,8 +325,10 @@ void avct_lcb_close_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
0, p_lcb->peer_addr);
} else {
p_ccb->p_lcb = NULL;
(*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), AVCT_DISCONNECT_IND_EVT,
0, p_lcb->peer_addr);
if (p_ccb->cc.p_ctrl_cback) {
(*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), AVCT_DISCONNECT_IND_EVT,
0, p_lcb->peer_addr);
}
}
}
}
@@ -359,8 +365,10 @@ void avct_lcb_close_cfm(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
avct_ccb_dealloc(p_ccb, event, p_data->result, p_lcb->peer_addr);
} else {
p_ccb->p_lcb = NULL;
(*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event,
p_data->result, p_lcb->peer_addr);
if (p_ccb->cc.p_ctrl_cback) {
(*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event,
p_data->result, p_lcb->peer_addr);
}
}
}
}
@@ -379,8 +387,10 @@ void avct_lcb_close_cfm(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
void avct_lcb_bind_conn(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
{
p_data->p_ccb->p_lcb = p_lcb;
(*p_data->p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_data->p_ccb),
AVCT_CONNECT_CFM_EVT, 0, p_lcb->peer_addr);
if (p_data->p_ccb->cc.p_ctrl_cback) {
(*p_data->p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_data->p_ccb),
AVCT_CONNECT_CFM_EVT, 0, p_lcb->peer_addr);
}
}
/*******************************************************************************
@@ -487,7 +497,9 @@ void avct_lcb_cong_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
/* send event to all ccbs on this lcb */
for (i = 0; i < AVCT_NUM_CONN; i++, p_ccb++) {
if (p_ccb->allocated && (p_ccb->p_lcb == p_lcb)) {
(*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event, 0, p_lcb->peer_addr);
if (p_ccb->cc.p_ctrl_cback) {
(*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event, 0, p_lcb->peer_addr);
}
}
}
}
@@ -689,7 +701,12 @@ void avct_lcb_msg_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
/* PID found; send msg up, adjust bt hdr and call msg callback */
p_data->p_buf->offset += AVCT_HDR_LEN_SINGLE;
p_data->p_buf->len -= AVCT_HDR_LEN_SINGLE;
(*p_ccb->cc.p_msg_cback)(avct_ccb_to_idx(p_ccb), label, cr_ipid, p_data->p_buf);
if (p_ccb->cc.p_msg_cback) {
(*p_ccb->cc.p_msg_cback)(avct_ccb_to_idx(p_ccb), label, cr_ipid, p_data->p_buf);
} else {
osi_free(p_data->p_buf);
p_data->p_buf = NULL;
}
} else {
/* PID not found; drop message */
AVCT_TRACE_WARNING("No ccb for PID=%x", pid);

4
components/bt/host/bluedroid/stack/avdt/avdt_api.c
View File

@@ -776,6 +776,10 @@ UINT16 AVDT_ReconfigReq(UINT8 handle, tAVDT_CFG *p_cfg)
UINT16 result = AVDT_SUCCESS;
tAVDT_SCB_EVT evt;
if (p_cfg == NULL) {
return AVDT_BAD_PARAMS;
}
/* map handle to scb */
if ((p_scb = avdt_scb_by_hdl(handle)) == NULL) {
result = AVDT_BAD_HANDLE;