Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid

Browse Source
This commit is contained in:
Jin Cheng
2026-05-06 18:05:14 +08:00
committed by Jin Cheng
parent 16f8e1fda1
commit af9ec3cd58
27 changed files with 438 additions and 245 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/l2cap/l2c_csm.c
+1 -2
View File
@@ -33,7 +33,6 @@
#include "l2c_int.h"
#include "btm_int.h"
#include "stack/btu.h"
#include "stack/hcimsgs.h"
#include "osi/allocator.h"
#if (L2CAP_COC_INCLUDED == TRUE)
@@ -121,7 +120,6 @@ void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
*******************************************************************************/
static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data;
UINT16 local_cid = p_ccb->local_cid;
tL2CA_DISCONNECT_IND_CB *disconnect_ind;
tL2CA_CONNECT_CFM_CB *connect_cfm;
@@ -168,6 +166,7 @@ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
break;
case L2CEVT_LP_CONNECT_CFM_NEG: /* Link failed */
tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data;
/* Disconnect unless ACL collision and upper layer wants to handle it */
if (p_ci->status != HCI_ERR_CONNECTION_EXISTS
|| !btm_acl_notif_conn_collision(p_ccb->p_lcb->remote_bd_addr)) {
components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c
+13 -13
View File
@@ -892,7 +892,7 @@ static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
/* If anything still waiting for ack, restart the timer if it was stopped */
if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q)) {
l2c_fcr_start_timer(p_ccb);
}
}
return (TRUE);
}
@@ -1342,7 +1342,7 @@ static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_wo
p_buf->len -= 2;
if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) {
L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_ccb->max_rx_mtu);
packet_ok = FALSE;
} else if ((p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL) {
L2CAP_TRACE_ERROR ("SAR - no buffer for SDU start user_rx_buf_size:%d", p_ccb->ertm_info.user_rx_buf_size);
@@ -1451,7 +1451,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
if (tx_seq == buf_seq) {
break;
}
}
}
}
@@ -1466,24 +1466,24 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
// the transmit data queue that satisfy the layer and event conditions.
for (const list_node_t *node = list_begin(p_ccb->p_lcb->link_xmit_data_q);
node != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
BT_HDR *p_buf = (BT_HDR *)list_node(node);
BT_HDR *p_node_buf = (BT_HDR *)list_node(node);
node = list_next(node);
/* Do not flush other CIDs or partial segments */
if ((p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid)) {
list_remove(p_ccb->p_lcb->link_xmit_data_q, p_buf);
osi_free(p_buf);
if ((p_node_buf->layer_specific == 0) && (p_node_buf->event == p_ccb->local_cid)) {
list_remove(p_ccb->p_lcb->link_xmit_data_q, p_node_buf);
osi_free(p_node_buf);
}
}
/* Also flush our retransmission queue */
while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q)) {
osi_free(fixed_queue_dequeue(p_ccb->fcrb.retrans_q, 0));
}
}
if (list_ack != NULL) {
node_ack = list_begin(list_ack);
}
}
}
if (list_ack != NULL) {
@@ -1502,7 +1502,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) ) {
break;
}
}
}
}
@@ -2150,11 +2150,11 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index]) {
p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
}
}
if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index]) {
p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
}
}
/* update sum, max and min of round trip delay of acking */
list_t *list = NULL;
@@ -2186,7 +2186,7 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
if ( delay < p_ccb->fcrb.ack_delay_min[index] ) {
p_ccb->fcrb.ack_delay_min[index] = delay;
}
}
}
}
}
components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c
+6 -1
View File
@@ -90,6 +90,12 @@ static void l2c_ucd_data_ind_cback (BD_ADDR rem_bda, BT_HDR *p_buf)
L2CAP_TRACE_DEBUG ("L2CAP - l2c_ucd_data_ind_cback");
if (p_buf->len < L2CAP_UCD_OVERHEAD) {
L2CAP_TRACE_ERROR ("L2CAP - data not enough for l2c_ucd_data_ind_cback %d", p_buf->len);
osi_free (p_buf);
return;
}
p = (UINT8 *)(p_buf + 1) + p_buf->offset;
STREAM_TO_UINT16(psm, p)
@@ -257,7 +263,6 @@ BOOLEAN L2CA_UcdDeregister_In_CCB_List (void *p_ccb_node, void * context)
BOOLEAN L2CA_UcdDeregister ( UINT16 psm )
{
tL2C_CCB *p_ccb;
tL2C_RCB *p_rcb;
UINT16 xx;
components/bt/host/bluedroid/stack/l2cap/l2cap_client.c
+7
View File
@@ -368,11 +368,18 @@ static void read_ready_cb(uint16_t local_channel_id, BT_HDR *packet)
l2cap_client_t *client = find(local_channel_id);
if (!client) {
L2CAP_TRACE_ERROR("%s unable to find L2CAP client matching LCID 0x%04x.\n", __func__, local_channel_id);
osi_free(packet);
return;
}
// TODO(sharvil): eliminate copy from BT_HDR.
buffer_t *buffer = buffer_new(packet->len);
if (!buffer) {
L2CAP_TRACE_ERROR("%s unable to new a buffer\n", __func__);
osi_free(packet);
return;
}
memcpy(buffer_ptr(buffer), packet->data + packet->offset, packet->len);
osi_free(packet);