From b068183cd8286dfc81b92993a35f00c607e6b5ed Mon Sep 17 00:00:00 2001 From: yangfeng Date: Wed, 25 Mar 2026 20:01:22 +0800 Subject: [PATCH] fix(bt): fix HFP api and btc component issues reported by AI review --- .../bt/host/bluedroid/api/esp_hf_ag_api.c | 60 +++++++++++- .../bt/host/bluedroid/api/esp_hf_client_api.c | 33 ++++++- .../bt/host/bluedroid/api/esp_pbac_api.c | 3 + .../btc/profile/std/hf_ag/bta_ag_co.c | 59 ++++++++---- .../btc/profile/std/hf_ag/btc_hf_ag.c | 34 +++---- .../profile/std/hf_client/bta_hf_client_co.c | 26 +++-- .../btc/profile/std/hf_client/btc_hf_client.c | 6 +- .../btc/profile/std/pba/btc_pba_client.c | 94 ++++++++++++++----- 8 files changed, 243 insertions(+), 72 deletions(-) diff --git a/components/bt/host/bluedroid/api/esp_hf_ag_api.c b/components/bt/host/bluedroid/api/esp_hf_ag_api.c index af3ddb4a1c6..158db5b2d72 100644 --- a/components/bt/host/bluedroid/api/esp_hf_ag_api.c +++ b/components/bt/host/bluedroid/api/esp_hf_ag_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -77,6 +77,9 @@ esp_err_t esp_hf_ag_slc_connect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -96,6 +99,9 @@ esp_err_t esp_hf_ag_slc_disconnect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -115,6 +121,9 @@ esp_err_t esp_hf_ag_audio_connect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -134,6 +143,9 @@ esp_err_t esp_hf_ag_audio_disconnect(esp_bd_addr_t remote_addr) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -153,6 +165,9 @@ esp_err_t esp_hf_ag_vra_control(esp_bd_addr_t remote_addr, esp_hf_vr_state_t val if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -161,7 +176,7 @@ esp_err_t esp_hf_ag_vra_control(esp_bd_addr_t remote_addr, esp_hf_vr_state_t val btc_hf_args_t arg; memset(&arg, 0, sizeof(btc_hf_args_t)); arg.vra_rep.value = value; - memcpy(&(arg.volcon.remote_addr), remote_addr, sizeof(esp_bd_addr_t)); + memcpy(&(arg.vra_rep.remote_addr), remote_addr, sizeof(esp_bd_addr_t)); /* Switch to BTC context */ bt_status_t status = btc_transfer_context(&msg, &arg, sizeof(btc_hf_args_t), NULL, NULL); @@ -173,6 +188,9 @@ esp_err_t esp_hf_ag_volume_control(esp_bd_addr_t remote_addr, esp_hf_volume_cont if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } if (volume < 0 || volume > 15) { return ESP_ERR_INVALID_ARG; } @@ -197,6 +215,9 @@ esp_err_t esp_hf_ag_unknown_at_send(esp_bd_addr_t remote_addr, char *unat) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL || unat == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -218,6 +239,9 @@ esp_err_t esp_hf_ag_cmee_send(esp_bd_addr_t remote_addr, esp_hf_at_response_code if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -268,6 +292,9 @@ esp_err_t esp_hf_ag_ciev_report(esp_bd_addr_t remote_addr, esp_hf_ciev_report_ty if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -293,6 +320,9 @@ esp_err_t esp_hf_ag_cind_response(esp_bd_addr_t remote_addr, if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } if (signal < 0 || signal > 5 || batt_lev < 0 || batt_lev > 5) { return ESP_ERR_INVALID_ARG; } @@ -323,6 +353,9 @@ esp_err_t esp_hf_ag_cops_response(esp_bd_addr_t remote_addr, char *name) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL || name == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -346,6 +379,9 @@ esp_err_t esp_hf_ag_clcc_response(esp_bd_addr_t remote_addr, int index, esp_hf_c if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -375,6 +411,9 @@ esp_err_t esp_hf_ag_cnum_response(esp_bd_addr_t remote_addr, char *number, int n if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } if (number == NULL || number_type < 128 || number_type > 175) { return ESP_ERR_INVALID_ARG; } @@ -385,7 +424,7 @@ esp_err_t esp_hf_ag_cnum_response(esp_bd_addr_t remote_addr, char *number, int n btc_hf_args_t arg; memset(&arg, 0, sizeof(btc_hf_args_t)); - memcpy(&(arg.cnum_rep), remote_addr, sizeof(esp_bd_addr_t)); + memcpy(&(arg.cnum_rep.remote_addr), remote_addr, sizeof(esp_bd_addr_t)); arg.cnum_rep.number = number; //deep_copy arg.cnum_rep.number_type = number_type; arg.cnum_rep.service_type = service_type; @@ -401,6 +440,9 @@ esp_err_t esp_hf_ag_bsir(esp_bd_addr_t remote_addr, esp_hf_in_band_ring_state_t if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -423,6 +465,9 @@ esp_err_t esp_hf_ag_answer_call(esp_bd_addr_t remote_addr, int num_active, int n if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -451,6 +496,9 @@ esp_err_t esp_hf_ag_reject_call(esp_bd_addr_t remote_addr, int num_active, int n if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -479,6 +527,9 @@ esp_err_t esp_hf_ag_end_call(esp_bd_addr_t remote_addr, int num_active, int num_ if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; @@ -507,6 +558,9 @@ esp_err_t esp_hf_ag_out_call(esp_bd_addr_t remote_addr, int num_active, int num_ if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HF; diff --git a/components/bt/host/bluedroid/api/esp_hf_client_api.c b/components/bt/host/bluedroid/api/esp_hf_client_api.c index 78347fc97fa..64ef18eb320 100644 --- a/components/bt/host/bluedroid/api/esp_hf_client_api.c +++ b/components/bt/host/bluedroid/api/esp_hf_client_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -68,6 +68,9 @@ esp_err_t esp_hf_client_connect(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -90,6 +93,9 @@ esp_err_t esp_hf_client_disconnect(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -112,6 +118,9 @@ esp_err_t esp_hf_client_connect_audio(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -134,6 +143,9 @@ esp_err_t esp_hf_client_disconnect_audio(esp_bd_addr_t remote_bda) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (remote_bda == NULL) { + return ESP_ERR_INVALID_ARG; + } bt_status_t stat; btc_hf_client_args_t arg; @@ -191,6 +203,9 @@ esp_err_t esp_hf_client_volume_update(esp_hf_volume_control_target_t type, int v if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (volume < 0 || volume > 15) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; btc_hf_client_args_t arg; @@ -391,6 +406,10 @@ esp_err_t esp_hf_client_send_dtmf(char code) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (!((code >= '0' && code <= '9') || code == '*' || code == '#' || + (code >= 'A' && code <= 'D'))) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; btc_hf_client_args_t arg; @@ -499,6 +518,9 @@ esp_err_t esp_hf_client_register_data_callback(esp_hf_client_incoming_data_cb_t if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (recv == NULL || send == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; @@ -553,6 +575,9 @@ esp_err_t esp_hf_client_pkt_stat_nums_get(uint16_t sync_conn_handle) void esp_hf_client_outgoing_data_ready(void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return; + } BTA_HfClientCiData(); } @@ -561,6 +586,9 @@ esp_err_t esp_hf_client_register_audio_data_callback(esp_hf_client_audio_data_cb if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (callback == NULL) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; @@ -616,6 +644,9 @@ esp_err_t esp_hf_client_audio_data_send(esp_hf_sync_conn_hdl_t sync_conn_hdl, es if (audio_buf == NULL || audio_buf->data_len == 0) { return ESP_ERR_INVALID_ARG; } + if (audio_buf->data_len > audio_buf->buff_size) { + return ESP_ERR_INVALID_ARG; + } BTA_HfClientAudioDataSend(sync_conn_hdl, (uint8_t *)audio_buf, audio_buf->data, audio_buf->data_len); return ESP_OK; diff --git a/components/bt/host/bluedroid/api/esp_pbac_api.c b/components/bt/host/bluedroid/api/esp_pbac_api.c index 3799038f94b..3d6273c2d6a 100644 --- a/components/bt/host/bluedroid/api/esp_pbac_api.c +++ b/components/bt/host/bluedroid/api/esp_pbac_api.c @@ -171,6 +171,9 @@ esp_err_t esp_pbac_set_phone_book2(esp_pbac_conn_hdl_t handle, const char *path) if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (handle == ESP_PBAC_INVALID_HANDLE) { + return ESP_ERR_INVALID_ARG; + } btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c index a604136dc60..3a0d8f465a5 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c @@ -70,7 +70,10 @@ static bta_hf_ct_plc_t *bta_hf_ct_plc_ptr; #define BTA_HF_H2_HEADER_SN1_BIT_OFFSET1 14 #define BTA_HF_H2_HEADER_SN1_BIT_OFFSET2 15 -#define BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p) ((*((uint16_t *)p) & BTA_HF_H2_HEADER_SYNC_WORD_MASK) == BTA_HF_H2_HEADER_SYNC_WORD) +#define BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p) \ + ((((UINT16)(((UINT8 *)(p))[0])) | (((UINT16)(((UINT8 *)(p))[1])) << 8)) & \ + BTA_HF_H2_HEADER_SYNC_WORD_MASK) == \ + BTA_HF_H2_HEADER_SYNC_WORD) /* BTA-AG-CO control block to map bdaddr to BTA handle */ typedef struct @@ -154,7 +157,7 @@ void bta_ag_ci_rx_write(UINT16 handle, char *p_data, UINT16 len) p_buf->hdr.event = BTA_AG_CI_RX_WRITE_EVT; p_buf->hdr.layer_specific = handle; p_data_area = (char *)(p_buf+1); /* Point to data area after header */ - strncpy(p_data_area, p_data, len); + memcpy(p_data_area, p_data, len); p_data_area[len] = 0; bta_sys_sendmsg(p_buf); } else { @@ -309,6 +312,7 @@ static void bta_ag_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN is_bad { bta_hf_ct_plc.first_good_frame_found = TRUE; sbc_plc_good_frame(&(bta_hf_ct_plc.plc_state), (int16_t *)bta_ag_co_cb.decode_raw_data, bta_hf_ct_plc.sbc_plc_out); + break; } case OI_CODEC_SBC_NOT_ENOUGH_HEADER_DATA: @@ -581,10 +585,16 @@ uint32_t bta_ag_sco_co_out_data(UINT8 *p_buf) void bta_ag_sco_co_in_data(BT_HDR *p_buf, tBTM_SCO_DATA_FLAG status) { UINT8 *p = (UINT8 *)(p_buf + 1) + p_buf->offset; + UINT8 * const data_end = p + p_buf->len; UINT8 pkt_size = 0; STREAM_SKIP_UINT16(p); STREAM_TO_UINT8(pkt_size, p); + UINT16 rem = (data_end > p) ? (UINT16)(data_end - p) : 0; + if (pkt_size > rem) { + pkt_size = (UINT8)rem; + } + #if (BTC_HFP_EXT_CODEC == TRUE) if (hf_air_mode == BTM_SCO_AIR_MODE_CVSD) { btc_hf_audio_data_cb_to_app((uint8_t *)p_buf, (uint8_t *)p, pkt_size, status != BTM_SCO_DATA_CORRECT); @@ -605,21 +615,29 @@ void bta_ag_sco_co_in_data(BT_HDR *p_buf, tBTM_SCO_DATA_FLAG status) osi_free(p_buf); } else { BT_HDR *p_new_buf = osi_calloc(sizeof(BT_HDR) + BTM_MSBC_FRAME_SIZE); - p_new_buf->offset = 0; - UINT8 *p_data = (UINT8 *)(p_new_buf + 1) + p_new_buf->offset; - memcpy(p_data, bta_ag_co_cb.rx_half_msbc_data, BTM_MSBC_FRAME_SIZE / 2); - memcpy(p_data + BTM_MSBC_FRAME_SIZE / 2, p, pkt_size); - osi_free(p_buf); - if (BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p_data)) { - /* H2 header sync word found, skip */ - p_data += 2; + if (p_new_buf == NULL) { + APPL_TRACE_ERROR("bta_ag_sco_co_in_data ENOMEM"); + osi_free(p_buf); + } else { + p_new_buf->offset = 0; + UINT8 *p_data = (UINT8 *)(p_new_buf + 1) + p_new_buf->offset; + UINT16 data_len = BTM_MSBC_FRAME_SIZE; + memcpy(p_data, bta_ag_co_cb.rx_half_msbc_data, BTM_MSBC_FRAME_SIZE / 2); + memcpy(p_data + BTM_MSBC_FRAME_SIZE / 2, p, pkt_size); + osi_free(p_buf); + if (BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p_data)) { + /* H2 header sync word found, skip */ + p_data += 2; + data_len -= 2; + } else if (!bta_ag_co_cb.is_bad_frame) { + /* not a bad frame, assume as H1 header */ + p_data += 1; + data_len -= 1; + } + btc_hf_audio_data_cb_to_app((uint8_t *)p_new_buf, (uint8_t *)p_data, data_len, + bta_ag_co_cb.is_bad_frame); + bta_ag_co_cb.is_bad_frame = FALSE; } - else if (!bta_ag_co_cb.is_bad_frame){ - /* not a bad frame, assume as H1 header */ - p_data += 1; - } - btc_hf_audio_data_cb_to_app((uint8_t *)p_new_buf, (uint8_t *)p_data, BTM_MSBC_FRAME_SIZE, bta_ag_co_cb.is_bad_frame); - bta_ag_co_cb.is_bad_frame = false; } bta_ag_co_cb.rx_first_pkt = !bta_ag_co_cb.rx_first_pkt; } @@ -627,21 +645,28 @@ void bta_ag_sco_co_in_data(BT_HDR *p_buf, tBTM_SCO_DATA_FLAG status) if (pkt_size > BTM_MSBC_FRAME_SIZE) { pkt_size = BTM_MSBC_FRAME_SIZE; } + UINT16 data_len = pkt_size; if (BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p)) { /* H2 header sync word found, skip */ p += 2; + data_len -= 2; } else if (!bta_ag_co_cb.is_bad_frame){ /* not a bad frame, assume as H1 header */ p += 1; + data_len -= 1; } - btc_hf_audio_data_cb_to_app((uint8_t *)p_buf, (uint8_t *)p, pkt_size, bta_ag_co_cb.is_bad_frame); + btc_hf_audio_data_cb_to_app((uint8_t *)p_buf, (uint8_t *)p, data_len, bta_ag_co_cb.is_bad_frame); bta_ag_co_cb.is_bad_frame = false; } else { osi_free(p_buf); } } + else { + APPL_TRACE_ERROR("bta_ag_sco_co_in_data EINVAL air mode: %d", hf_air_mode); + osi_free(p_buf); + } #else if (hf_air_mode == BTM_SCO_AIR_MODE_CVSD) { // CVSD diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c index b5a731f6a77..8d1fe4c38f9 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -618,7 +618,7 @@ static bt_status_t btc_hf_cind_response(bt_bdaddr_t *bd_addr, if (is_connected(idx, bd_addr)) { tBTA_AG_RES_DATA ag_res; memset(&ag_res, 0, sizeof (ag_res)); - sprintf(ag_res.str, "%d,%d,%d,%d,%d,%d,%d", + snprintf(ag_res.str, sizeof(ag_res.str), "%d,%d,%d,%d,%d,%d,%d", call_status, /* Call state*/ call_setup_status, /* Callsetup state */ ntk_state, /* network service */ @@ -643,7 +643,7 @@ static bt_status_t btc_hf_cops_response(bt_bdaddr_t *bd_addr, const char *name) tBTA_AG_RES_DATA ag_res; memset (&ag_res, 0, sizeof (ag_res)); /* Format the response */ - sprintf(ag_res.str, "0,0,\"%s\"", name); + snprintf(ag_res.str, sizeof(ag_res.str), "0,0,\"%s\"", name); ag_res.ok_flag = BTA_AG_OK_DONE; BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_COPS_RES, &ag_res); return BT_STATUS_SUCCESS; @@ -668,12 +668,12 @@ static bt_status_t btc_hf_clcc_response(bt_bdaddr_t *bd_addr, int index, esp_hf_ } else { BTC_TRACE_EVENT("clcc_response: [%d] dir: %d current_call_state: %d mode: %d number: %s type: %d", index, dir, current_call_state, mode, number, type); - int loc = sprintf (ag_res.str, "%d,%d,%d,%d,%d", index, dir, current_call_state, mode, mpty); - if (number) { + int loc = snprintf(ag_res.str, sizeof(ag_res.str), "%d,%d,%d,%d,%d", index, dir, current_call_state, mode, mpty); + if (number && loc >= 0 && (size_t)loc < sizeof(ag_res.str)) { if ((type == ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL) && (*number != '+')) { - sprintf(&ag_res.str[loc], ",\"+%s\",%d", number, type); + snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",\"+%s\",%d", number, type); } else { - sprintf(&ag_res.str[loc], ",\"%s\",%d", number, type); + snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",\"%s\",%d", number, type); } } } @@ -694,9 +694,9 @@ static bt_status_t btc_hf_cnum_response(bt_bdaddr_t *bd_addr, const char *number memset(&ag_res, 0, sizeof (ag_res)); BTC_TRACE_EVENT("cnum_response: number = %s, number type = %d, service type = %d", number, number_type, service_type); if (service_type) { - sprintf(ag_res.str, ",\"%s\",%d,,%d",number, number_type, service_type); + snprintf(ag_res.str, sizeof(ag_res.str), ",\"%s\",%d,,%d", number, number_type, service_type); } else { - sprintf(ag_res.str, ",\"%s\",%d,,",number, number_type); + snprintf(ag_res.str, sizeof(ag_res.str), ",\"%s\",%d,,", number, number_type); } ag_res.ok_flag = BTA_AG_OK_DONE; BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_CNUM_RES, &ag_res); @@ -855,13 +855,13 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active if (number) { int loc = 0; if ((type == ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL) && (*number != '+')) { - loc = sprintf (ag_res.str, "\"+%s\"", number); + loc = snprintf(ag_res.str, sizeof(ag_res.str), "\"+%s\"", number); } else { - loc = sprintf (ag_res.str, "\"%s\"", number); + loc = snprintf(ag_res.str, sizeof(ag_res.str), "\"%s\"", number); } ag_res.num = type; - if (res == BTA_AG_CALL_WAIT_RES) { - sprintf(&ag_res.str[loc], ",%d", type); + if (res == BTA_AG_CALL_WAIT_RES && loc >= 0 && (size_t)loc < sizeof(ag_res.str)) { + snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",%d", type); } } break; @@ -1613,9 +1613,11 @@ void btc_hf_cb_handler(btc_msg_t *msg) memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t)); param.out_call.type = p_data->val.value; param.out_call.num_or_loc = osi_malloc((strlen(p_data->val.str) + 1) * sizeof(char)); - sprintf(param.out_call.num_or_loc, "%s", p_data->val.str); - btc_hf_cb_to_app(ESP_HF_DIAL_EVT, ¶m); - osi_free(param.out_call.num_or_loc); + if (param.out_call.num_or_loc) { + snprintf(param.out_call.num_or_loc, strlen(p_data->val.str) + 1, "%s", p_data->val.str); + btc_hf_cb_to_app(ESP_HF_DIAL_EVT, ¶m); + osi_free(param.out_call.num_or_loc); + } } else if (event == BTA_AG_AT_BLDN_EVT) { //dial_last memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t)); param.out_call.num_or_loc = NULL; diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c index c785c73907a..3f37a3ae074 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -30,7 +30,10 @@ #define BTA_HF_H2_HEADER_SN1_BIT_OFFSET1 14 #define BTA_HF_H2_HEADER_SN1_BIT_OFFSET2 15 -#define BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p) ((*((uint16_t *)p) & BTA_HF_H2_HEADER_SYNC_WORD_MASK) == BTA_HF_H2_HEADER_SYNC_WORD) +#define BTA_HF_H2_HEADER_SYNC_WORD_CHECK(p) \ + ((((UINT16)(((UINT8 *)(p))[0])) | (((UINT16)(((UINT8 *)(p))[1])) << 8)) & \ + BTA_HF_H2_HEADER_SYNC_WORD_MASK) == \ + BTA_HF_H2_HEADER_SYNC_WORD) #if (PLC_INCLUDED == TRUE) #include "sbc_plc.h" @@ -230,7 +233,7 @@ void bta_hf_client_sco_co_open(UINT16 handle, UINT8 air_mode, UINT8 inout_pkt_si #if (PLC_INCLUDED == TRUE) bta_hf_ct_plc_ptr = (bta_hf_ct_plc_t *)osi_calloc(sizeof(bta_hf_ct_plc_t)); - if (!bta_hf_ct_plc_ptr) { + if (!bta_hf_ct_plc_ptr) { APPL_TRACE_ERROR("%s malloc fail.", __FUNCTION__); goto error_exit; } @@ -287,12 +290,16 @@ void bta_hf_client_sco_co_close(void) if (hf_air_mode == BTM_SCO_AIR_MODE_TRANSPNT) { #if (PLC_INCLUDED == TRUE) +#if (HFP_DYNAMIC_MEMORY == TRUE) + if (bta_hf_ct_plc_ptr != NULL) { + sbc_plc_deinit(&(bta_hf_ct_plc.plc_state)); + bta_hf_ct_plc.first_good_frame_found = FALSE; + osi_free(bta_hf_ct_plc_ptr); + bta_hf_ct_plc_ptr = NULL; + } +#else sbc_plc_deinit(&(bta_hf_ct_plc.plc_state)); bta_hf_ct_plc.first_good_frame_found = FALSE; - -#if (HFP_DYNAMIC_MEMORY == TRUE) - osi_free(bta_hf_ct_plc_ptr); - bta_hf_ct_plc_ptr = NULL; #endif /// (HFP_DYNAMIC_MEMORY == TRUE) #endif ///(PLC_INCLUDED == TRUE) @@ -430,6 +437,7 @@ static void bta_hf_client_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN case OI_OK: bta_hf_ct_plc.first_good_frame_found = TRUE; sbc_plc_good_frame(&(bta_hf_ct_plc.plc_state), (int16_t *)bta_hf_client_co_cb.decode_raw_data, bta_hf_ct_plc.sbc_plc_out); + break; case OI_CODEC_SBC_NOT_ENOUGH_HEADER_DATA: case OI_CODEC_SBC_NOT_ENOUGH_BODY_DATA: case OI_CODEC_SBC_NOT_ENOUGH_AUDIO_DATA: @@ -463,11 +471,11 @@ static void bta_hf_client_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN APPL_TRACE_ERROR("Frame decode error: %d", status); break; } -#endif ///(PLC_INCLUDED == TRUE) - if (OI_SUCCESS(status)){ + if (OI_SUCCESS(status)) { btc_hf_client_incoming_data_cb_to_app((const uint8_t *)(bta_hf_ct_plc.sbc_plc_out), sbc_raw_data_size); } +#endif ///(PLC_INCLUDED == TRUE) } #endif diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c index cac3afb5e08..b4813c16337 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c +++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -14,7 +14,6 @@ #include #include #include -#include #include "common/bt_defs.h" #include "device/bdaddr.h" #include "btc/btc_dm.h" @@ -537,6 +536,8 @@ static bt_status_t btc_hf_client_send_chld_cmd(esp_hf_chld_type_t type, int idx) } return BT_STATUS_UNSUPPORTED; + default: + return BT_STATUS_FAIL; } return BT_STATUS_SUCCESS; } @@ -1069,7 +1070,6 @@ void btc_hf_client_cb_handler(btc_msg_t *msg) param.cnum.type = ESP_HF_SUBSCRIBER_SERVICE_TYPE_UNKNOWN; } btc_hf_client_cb_to_app(ESP_HF_CLIENT_CNUM_EVT, ¶m); - break; } while (0); break; case BTA_HF_CLIENT_BTRH_EVT: diff --git a/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c b/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c index 6bc1819872b..8f3e2a7fa1b 100644 --- a/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c +++ b/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -14,6 +14,8 @@ #include "btc/btc_task.h" #include "btc_pba_client.h" #include "esp_pbac_api.h" +#include +#include #if BTC_PBA_CLIENT_INCLUDED @@ -227,7 +229,12 @@ static bool btc_pba_client_pull_phone_book(uint16_t handle, char *name, bool inc UINT8_TO_BE_STREAM(p, app_param->vcard_selector_operator); } app_param_len = p - app_param_buff; - assert(app_param_len <= BTA_PBAP_PULL_PHONE_BOOK_APP_PARAM_BUFF_SIZE_MIN); + if (app_param_len > BTA_PBAP_PULL_PHONE_BOOK_APP_PARAM_BUFF_SIZE_MIN) { + osi_free(app_param_buff); + app_param_buff = NULL; + err = BT_STATUS_FAIL; + break; + } if (app_param_len == 0) { /* user give us an empty app param, allow but not recommend */ osi_free(app_param_buff); @@ -391,9 +398,18 @@ static bool btc_pba_client_pull_vcard_listing(uint16_t handle, char *name, bool } if (include_app_param) { - uint8_t search_value_len = 0; - if (app_param->include_search_value && app_param->search_value) { - search_value_len = strlen(app_param->search_value) + 1; + size_t search_value_len = 0; + if (app_param->include_search_value) { + if (app_param->search_value == NULL) { + err = BT_STATUS_PARM_INVALID; + break; + } + size_t sl = strlen(app_param->search_value); + if (sl >= UINT8_MAX) { + err = BT_STATUS_PARM_INVALID; + break; + } + search_value_len = sl + 1; } app_param_buff = osi_malloc(BTA_PBAP_PULL_VCARD_LISTING_APP_PARAM_BUFF_SIZE_MIN + search_value_len); if (app_param_buff == NULL) { @@ -409,7 +425,7 @@ static bool btc_pba_client_pull_vcard_listing(uint16_t handle, char *name, bool } if (app_param->include_search_value) { UINT8_TO_BE_STREAM(p, BTA_PBAP_APP_PARAM_SEARCH_VALUE); - UINT8_TO_BE_STREAM(p, search_value_len); + UINT8_TO_BE_STREAM(p, (uint8_t)search_value_len); memcpy(p, app_param->search_value, search_value_len); p += search_value_len; } @@ -444,7 +460,12 @@ static bool btc_pba_client_pull_vcard_listing(uint16_t handle, char *name, bool UINT8_TO_BE_STREAM(p, app_param->vcard_selector_operator); } app_param_len = p - app_param_buff; - assert(app_param_len <= BTA_PBAP_PULL_VCARD_LISTING_APP_PARAM_BUFF_SIZE_MIN + search_value_len); + if (app_param_len > BTA_PBAP_PULL_VCARD_LISTING_APP_PARAM_BUFF_SIZE_MIN + search_value_len) { + osi_free(app_param_buff); + app_param_buff = NULL; + err = BT_STATUS_FAIL; + break; + } if (app_param_len == 0) { /* user give us an empty app param, allow but not recommend */ osi_free(app_param_buff); @@ -520,7 +541,12 @@ static bool btc_pba_client_pull_vcard_entry(uint16_t handle, char *name, bool in UINT8_TO_BE_STREAM(p, app_param->format); } app_param_len = p - app_param_buff; - assert(app_param_len <= BTA_PBAP_PULL_VCARD_ENTRY_APP_PARAM_BUFF_SIZE_MIN); + if (app_param_len > BTA_PBAP_PULL_VCARD_ENTRY_APP_PARAM_BUFF_SIZE_MIN) { + osi_free(app_param_buff); + app_param_buff = NULL; + err = BT_STATUS_FAIL; + break; + } if (app_param_len == 0) { /* user give us an empty app param, allow but not recommend */ osi_free(app_param_buff); @@ -564,6 +590,7 @@ void btc_pba_client_args_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->pull_vcard_listing.name, src->pull_vcard_listing.name, len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __FUNCTION__, msg->act); + break; } if (src->pull_vcard_listing.include_app_param && src->pull_vcard_listing.app_param.include_search_value) { len = strlen(src->pull_vcard_listing.app_param.search_value) + 1; @@ -572,6 +599,8 @@ void btc_pba_client_args_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->pull_vcard_listing.app_param.search_value, src->pull_vcard_listing.app_param.search_value, len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __FUNCTION__, msg->act); + osi_free(dst->pull_vcard_listing.name); + dst->pull_vcard_listing.name = NULL; } } break; @@ -834,15 +863,20 @@ void btc_pba_client_cb_handler(btc_msg_t *msg) switch (event) { case BTA_PBA_CLIENT_CONN_OPEN_EVT: if (p_data->conn.error == BTA_PBA_CLIENT_NO_ERROR) { - /* allocate ccb */ - p_ccb = &btc_pba_client_cb.ccb[p_data->conn.handle - 1]; - p_ccb->handle = p_data->conn.handle; - bdcpy(p_ccb->bd_addr.address, p_data->conn.bd_addr); - p_ccb->busy = false; - param.conn_stat.connected = true; - param.conn_stat.peer_supported_repo = p_data->conn.peer_supported_repo; - param.conn_stat.peer_supported_feat = p_data->conn.peer_supported_feat; - param.conn_stat.reason = BTA_PBA_CLIENT_NO_ERROR; + if (p_data->conn.handle >= 1 && p_data->conn.handle <= BTC_PBA_CLIENT_MAX_CONN_NUM) { + p_ccb = &btc_pba_client_cb.ccb[p_data->conn.handle - 1]; + p_ccb->handle = p_data->conn.handle; + bdcpy(p_ccb->bd_addr.address, p_data->conn.bd_addr); + p_ccb->busy = false; + param.conn_stat.connected = true; + param.conn_stat.peer_supported_repo = p_data->conn.peer_supported_repo; + param.conn_stat.peer_supported_feat = p_data->conn.peer_supported_feat; + param.conn_stat.reason = BTA_PBA_CLIENT_NO_ERROR; + } else { + BTC_TRACE_ERROR("CONN_OPEN EINVAL handle:%u", p_data->conn.handle); + param.conn_stat.connected = false; + param.conn_stat.reason = BTA_PBA_CLIENT_FAIL; + } } else { param.conn_stat.connected = false; @@ -855,8 +889,7 @@ void btc_pba_client_cb_handler(btc_msg_t *msg) btc_queue_advance(); break; case BTA_PBA_CLIENT_CONN_CLOSE_EVT: - if (p_data->conn.handle != 0) { - /* clear ccb */ + if (p_data->conn.handle >= 1 && p_data->conn.handle <= BTC_PBA_CLIENT_MAX_CONN_NUM) { p_ccb = &btc_pba_client_cb.ccb[p_data->conn.handle - 1]; if (p_ccb->path) { osi_free(p_ccb->path); @@ -873,8 +906,16 @@ void btc_pba_client_cb_handler(btc_msg_t *msg) break; case BTA_PBA_CLIENT_PULL_PHONE_BOOK_RSP_EVT: if (p_data->response.final) { - p_ccb = &btc_pba_client_cb.ccb[p_data->response.handle - 1]; - p_ccb->busy = false; + if (p_data->response.handle >= 1 && p_data->response.handle <= BTC_PBA_CLIENT_MAX_CONN_NUM) { + p_ccb = &btc_pba_client_cb.ccb[p_data->response.handle - 1]; + p_ccb->busy = false; + } else { + BTC_TRACE_ERROR("PULL_PHONE_BOOK_RSP EINVAL handle:%u", p_data->response.handle); + if (p_data->response.pkt != NULL) { + osi_free(p_data->response.pkt); + } + break; + } } param.pull_phone_book_rsp.handle = p_data->response.handle; param.pull_phone_book_rsp.final = p_data->response.final; @@ -888,6 +929,13 @@ void btc_pba_client_cb_handler(btc_msg_t *msg) } break; case BTA_PBA_CLIENT_SET_PHONE_BOOK_RSP_EVT: + if (!(p_data->response.handle >= 1 && p_data->response.handle <= BTC_PBA_CLIENT_MAX_CONN_NUM)) { + BTC_TRACE_ERROR("SET_PHONE_BOOK_RSP EINVAL handle:%u", p_data->response.handle); + if (p_data->response.pkt != NULL) { + osi_free(p_data->response.pkt); + } + break; + } p_ccb = &btc_pba_client_cb.ccb[p_data->response.handle - 1]; if (p_data->response.status == BTA_PBA_CLIENT_NO_ERROR && p_ccb->path_pos < p_ccb->path_len) { /* since path_len is not zero, path should not be NULL, use asset to check */ @@ -920,7 +968,7 @@ void btc_pba_client_cb_handler(btc_msg_t *msg) } break; case BTA_PBA_CLIENT_PULL_VCARD_LISTING_RSP_EVT: - if (p_data->response.final) { + if (p_data->response.final && p_data->response.handle >= 1 && p_data->response.handle <= BTC_PBA_CLIENT_MAX_CONN_NUM) { p_ccb = &btc_pba_client_cb.ccb[p_data->response.handle - 1]; p_ccb->busy = false; } @@ -936,7 +984,7 @@ void btc_pba_client_cb_handler(btc_msg_t *msg) } break; case BTA_PBA_CLIENT_PULL_VCARD_ENTRY_RSP_EVT: - if (p_data->response.final) { + if (p_data->response.final && p_data->response.handle >= 1 && p_data->response.handle <= BTC_PBA_CLIENT_MAX_CONN_NUM) { p_ccb = &btc_pba_client_cb.ccb[p_data->response.handle - 1]; p_ccb->busy = false; }