From b73af73f4df77ba499b0cc637b4eccda168be786 Mon Sep 17 00:00:00 2001 From: Zhi Wei Jian Date: Wed, 10 Jun 2026 19:53:35 +0800 Subject: [PATCH] fix(ble/bluedroid): fix GAP BLE API parameter validation (cherry picked from commit e3311c81c4705db2614eb83e215e76e255ca840b) Co-authored-by: zhiweijian --- .../bt/host/bluedroid/api/esp_gap_ble_api.c | 60 ++++++- .../api/include/api/esp_gap_ble_api.h | 6 +- .../btc/profile/std/gap/btc_gap_ble.c | 164 ++++++++++++++---- .../bt/host/bluedroid/stack/btm/btm_acl.c | 6 +- .../bt/host/bluedroid/stack/btm/btm_ble.c | 16 +- .../host/bluedroid/stack/btm/btm_ble_5_gap.c | 6 +- .../bluedroid/stack/btm/btm_ble_privacy.c | 3 + .../bt/host/bluedroid/stack/btm/btm_devctl.c | 16 +- .../bluedroid/stack/btm/include/btm_ble_int.h | 2 +- .../bluedroid/stack/btm/include/btm_int.h | 4 +- .../bluedroid/stack/include/stack/btm_api.h | 9 +- .../stack/include/stack/btm_ble_api.h | 11 +- 12 files changed, 232 insertions(+), 71 deletions(-) diff --git a/components/bt/host/bluedroid/api/esp_gap_ble_api.c b/components/bt/host/bluedroid/api/esp_gap_ble_api.c index 311c5d281ca..9ac5a99b3bc 100644 --- a/components/bt/host/bluedroid/api/esp_gap_ble_api.c +++ b/components/bt/host/bluedroid/api/esp_gap_ble_api.c @@ -15,6 +15,9 @@ #include "btc/btc_ble_storage.h" #include "esp_random.h" +/* Hard upper bound to prevent excessive allocations in BTC/BTA layers. */ +#define ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN 1650U + esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -158,7 +161,22 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params) ESP_BLE_IS_VALID_PARAM(params->max_int, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) && ESP_BLE_IS_VALID_PARAM(params->timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) && (params->latency <= ESP_BLE_CONN_LATENCY_MAX) && - ((params->timeout * 10) >= ((1 + params->latency) * ((params->max_int * 5) >> 1))) && params->min_int <= params->max_int) { + /* + * Core Spec (Vol 6, Part B, Section 4.5.2): + * supervision_timeout shall be strictly greater than + * (1 + connSlaveLatency) * connIntervalMax * 2. + * + * Here: + * - timeout is in 10 ms units + * - max_int is in 1.25 ms units + * + * Convert both sides into 0.5 ms units to avoid truncation: + * (timeout * 10 ms) -> timeout * 20 (0.5 ms units) + * (max_int * 1.25 ms * 2) -> max_int * 5 (0.5 ms units) + */ + (((uint32_t)params->timeout * 20U) > + ((uint32_t)(1U + (uint32_t)params->latency) * (uint32_t)params->max_int * 5U)) && + (params->min_int <= params->max_int)) { msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -339,7 +357,7 @@ esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda return ESP_ERR_INVALID_STATE; } if (!remote_bda){ - return ESP_ERR_INVALID_SIZE; + return ESP_ERR_INVALID_ARG; } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -369,7 +387,7 @@ esp_err_t esp_ble_gap_clear_whitelist(void) esp_err_t esp_ble_gap_get_whitelist_size(uint16_t *length) { if (length == NULL) { - return ESP_FAIL; + return ESP_ERR_INVALID_ARG; } ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); btc_get_whitelist_size(length); @@ -397,7 +415,9 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr, ESP_BLE_IS_VALID_PARAM(max_conn_int, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) && ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) && (slave_latency <= ESP_BLE_CONN_LATENCY_MAX) && - ((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) { + (((uint32_t)supervision_tout * 20U) > + ((uint32_t)(1U + (uint32_t)slave_latency) * (uint32_t)max_conn_int * 5U)) && + (min_conn_int <= max_conn_int)) { msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -678,7 +698,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type, uint32_t passkey = 0; for(uint8_t i = 0; i < len; i++) { - passkey += (((uint8_t *)value)[i]<<(8*i)); + passkey += ((uint32_t)((const uint8_t *)value)[i] << (8U * (uint32_t)i)); } if(passkey > 999999) { return ESP_ERR_INVALID_ARG; @@ -846,6 +866,15 @@ esp_err_t esp_ble_get_bond_device_list(int *dev_num, esp_ble_bond_dev_t *dev_lis *dev_num = dev_num_total; } + /* + * The storage layer updates some fields using |= (e.g. key_mask). Ensure + * the caller-provided list is zero-initialized to avoid propagating + * uninitialized heap contents (including padding) back to the caller. + */ + if (*dev_num > 0) { + memset(dev_list, 0, sizeof(*dev_list) * (size_t)(*dev_num)); + } + ret = btc_storage_get_bonded_ble_devices_list(dev_list, *dev_num); return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -1293,6 +1322,10 @@ esp_err_t esp_ble_gap_config_ext_adv_data_raw(uint8_t instance, uint16_t length, return ESP_ERR_INVALID_ARG; } + if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -1319,6 +1352,10 @@ esp_err_t esp_ble_gap_config_ext_scan_rsp_data_raw(uint8_t instance, uint16_t le return ESP_ERR_INVALID_ARG; } + if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW; @@ -1454,6 +1491,10 @@ esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t le return ESP_ERR_INVALID_ARG; } + if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -1751,7 +1792,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) && ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) && (phy_1m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) && - ((phy_1m_conn_params->supervision_timeout * 10) >= ((1 + phy_1m_conn_params->latency) * ((phy_1m_conn_params->interval_max * 5) >> 1))) && + (((uint32_t)phy_1m_conn_params->supervision_timeout * 20U) > + ((uint32_t)(1U + (uint32_t)phy_1m_conn_params->latency) * (uint32_t)phy_1m_conn_params->interval_max * 5U)) && (phy_1m_conn_params->interval_min <= phy_1m_conn_params->interval_max)) { memcpy(&arg.set_ext_conn_params.phy_1m_conn_params, phy_1m_conn_params, sizeof(esp_ble_gap_conn_params_t)); @@ -1775,7 +1817,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) && ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) && (phy_2m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) && - ((phy_2m_conn_params->supervision_timeout * 10) >= ((1 + phy_2m_conn_params->latency) * ((phy_2m_conn_params->interval_max * 5) >> 1))) && + (((uint32_t)phy_2m_conn_params->supervision_timeout * 20U) > + ((uint32_t)(1U + (uint32_t)phy_2m_conn_params->latency) * (uint32_t)phy_2m_conn_params->interval_max * 5U)) && (phy_2m_conn_params->interval_min <= phy_2m_conn_params->interval_max)) { memcpy(&arg.set_ext_conn_params.phy_2m_conn_params, phy_2m_conn_params, sizeof(esp_ble_gap_conn_params_t)); @@ -1799,7 +1842,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) && ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) && (phy_coded_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) && - ((phy_coded_conn_params->supervision_timeout * 10) >= ((1 + phy_coded_conn_params->latency) * ((phy_coded_conn_params->interval_max * 5) >> 1))) && + (((uint32_t)phy_coded_conn_params->supervision_timeout * 20U) > + ((uint32_t)(1U + (uint32_t)phy_coded_conn_params->latency) * (uint32_t)phy_coded_conn_params->interval_max * 5U)) && (phy_coded_conn_params->interval_min <= phy_coded_conn_params->interval_max)) { memcpy(&arg.set_ext_conn_params.phy_coded_conn_params, phy_coded_conn_params, sizeof(esp_ble_gap_conn_params_t)); diff --git a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h index 38527126f91..ab4e762a3ea 100644 --- a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h +++ b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h @@ -2532,7 +2532,6 @@ typedef union { */ struct ble_cs_read_local_supp_caps_evt { esp_bt_status_t status; /*!< Indicate channel sounding read local supported capabilities command successfully completed */ - uint16_t conn_handle; /*!< Connection Handle */ uint8_t num_config_supported; /*!< Number of CS configurations supported per connection */ uint16_t max_consecutive_proc_supported; /*!< 0x0000: Support for both a fixed number of consecutive CS procedures and for an indefinite number of CS procedures until termination 0x0001 to 0xFFFF: Maximum number of consecutive CS procedures supported */ @@ -3113,6 +3112,11 @@ esp_err_t esp_ble_gap_add_device_to_resolving_list(esp_bd_addr_t peer_addr, uint /** * @brief This function clears the random address for the application * + * @note This function shall not be used when: + * - Advertising is enabled, + * - Scanning is enabled, or + * - any LE connection exists / a create connection command is pending. + * * @return * - ESP_OK : success * - other : failed diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c index 29eb4d993f8..b53caf492f6 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c @@ -490,7 +490,8 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params) tBLE_BD_ADDR peer_addr; esp_bt_status_t status = ESP_BT_STATUS_SUCCESS; if (!BLE_ISVALID_PARAM(ble_adv_params->adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) || - !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) { + !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) || + ble_adv_params->adv_int_min > ble_adv_params->adv_int_max) { status = ESP_BT_STATUS_PARM_INVALID; BTC_TRACE_ERROR("Invalid advertisting interval parameters.\n"); } @@ -563,7 +564,8 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params) BLE_ISVALID_PARAM(scan_params->own_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RPA_RANDOM) && BLE_ISVALID_PARAM(scan_params->scan_filter_policy, BLE_SCAN_FILTER_ALLOW_ALL, BLE_SCAN_FILTER_ALLOW_WLIST_RPA_DIR) && BLE_ISVALID_PARAM(scan_params->scan_duplicate, BLE_SCAN_DUPLICATE_DISABLE, BLE_SCAN_DUPLICATE_MAX -1) && - (scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS)) { + (scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS) && + scan_params->scan_window <= scan_params->scan_interval) { BTA_DmSetBleScanFilterParams(ESP_DEFAULT_GATT_IF, /*client_if*/ scan_params->scan_interval, scan_params->scan_window, @@ -934,7 +936,7 @@ static void btc_read_ble_rssi_cmpl_callback(void *p_data) static void btc_ble_read_channel_map_callback(void *p_data) { tBTA_BLE_CH_MAP_RESULTS *result = (tBTA_BLE_CH_MAP_RESULTS *)p_data; - esp_ble_gap_cb_param_t param; + esp_ble_gap_cb_param_t param = {0}; bt_status_t ret; btc_msg_t msg = {0}; @@ -1227,7 +1229,14 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event, #if (BLE_50_EXTEND_SCAN_EN == TRUE) case BTA_DM_BLE_5_GAP_EXT_ADV_REPORT_EVT: msg.act = ESP_GAP_BLE_EXT_ADV_REPORT_EVT; - memcpy(¶m.ext_adv_report.params, ¶ms->ext_adv_report, sizeof(esp_ble_gap_ext_adv_report_t)); + memcpy(¶m.ext_adv_report.params, ¶ms->ext_adv_report, sizeof(tBTM_BLE_EXT_ADV_REPORT)); + /* The source struct ends with a pointer (UINT8 *adv_data) while the destination + * ends with a fixed array (uint8_t adv_data[251]). The memcpy above leaves the + * raw pointer bytes at the start of adv_data[]. Clear it before copying the real + * advertising payload to avoid leaking stale pointer bytes when adv_data is NULL + * or adv_data_len is smaller than sizeof(void *). */ + memset(param.ext_adv_report.params.adv_data, 0, + sizeof(param.ext_adv_report.params.adv_data)); if (params->ext_adv_report.adv_data) { memcpy(param.ext_adv_report.params.adv_data, params->ext_adv_report.adv_data, params->ext_adv_report.adv_data_len); @@ -1481,7 +1490,6 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event, case BTA_BLE_GAP_CS_READ_LOCAL_SUPP_CAPS_EVT: msg.act = ESP_GAP_BLE_CS_READ_LOCAL_SUPP_CAPS_EVT; param.cs_read_local_supp_caps.status = btc_btm_status_to_esp_status(params->cs_read_local_supp_caps.status); - param.cs_read_local_supp_caps.conn_handle = params->cs_read_local_supp_caps.conn_handle; param.cs_read_local_supp_caps.num_config_supported = params->cs_read_local_supp_caps.num_config_supported; param.cs_read_local_supp_caps.max_consecutive_proc_supported = params->cs_read_local_supp_caps.max_consecutive_proc_supported; param.cs_read_local_supp_caps.num_ant_supported = params->cs_read_local_supp_caps.num_ant_supported; @@ -1646,12 +1654,12 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event, #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE)) -void btc_dtm_tx_start_callback(void *p1) +void btc_dtm_tx_start_callback(UINT8 *p1, UINT16 len) { UINT8 status; UINT8 *p; p = (UINT8*) p1; - if (p1) { + if (p1 && len >= 1) { STREAM_TO_UINT8(status, p); BTC_TRACE_DEBUG("DTM TX start, status 0x%x\n", status); esp_ble_gap_cb_param_t param; @@ -1673,13 +1681,13 @@ void btc_dtm_tx_start_callback(void *p1) } } -void btc_dtm_rx_start_callback(void *p1) +void btc_dtm_rx_start_callback(UINT8 *p1, UINT16 len) { UINT8 status; UINT8 *p; p = (UINT8*) p1; - if (p1) { + if (p1 && len >= 1) { STREAM_TO_UINT8(status, p); BTC_TRACE_DEBUG("DTM RX start, status 0x%x\n", status); esp_ble_gap_cb_param_t param; @@ -1703,13 +1711,13 @@ void btc_dtm_rx_start_callback(void *p1) #endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE)) #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE)) -void btc_dtm_stop_callback(void *p1) +void btc_dtm_stop_callback(UINT8 *p1, UINT16 len) { UINT8 status; UINT16 num_pkt; UINT8 *p; p = (UINT8*) p1; - if (p1) { + if (p1 && len >= 3) { STREAM_TO_UINT8(status, p); STREAM_TO_UINT16(num_pkt, p); BTC_TRACE_DEBUG("DTM stop, status 0x%x num_pkt %d\n", status, num_pkt); @@ -1874,6 +1882,13 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len btc_msg_t msg = {0}; esp_ble_vendor_evt_param_t *evt_param = ¶m.vendor_hci_evt.param; bool copy_param = false; + bool parse_ok = true; + + if (param_len && params == NULL) { + BTC_TRACE_WARNING("%s vendor evt NULL: sub=0x%02x len=%u", + __func__, subevt_code, param_len); + return; + } msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; @@ -1885,6 +1900,12 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len switch (subevt_code) { case BLE_VENDOR_PDU_RECV_EVT: param.vendor_hci_evt.subevt_code = ESP_BLE_VENDOR_PDU_RECV_EVT; + if (param_len < (UINT8)(1 + 1 + 1 + BD_ADDR_LEN)) { + BTC_TRACE_WARNING("%s vendor trunc: sub=0x%02x len=%u<%u", + __func__, subevt_code, param_len, (unsigned)(1 + 1 + 1 + BD_ADDR_LEN)); + parse_ok = false; + break; + } STREAM_TO_UINT8(evt_param->pdu_recv.type, params); STREAM_TO_UINT8(evt_param->pdu_recv.handle, params); STREAM_TO_UINT8(evt_param->pdu_recv.addr_type, params); @@ -1892,6 +1913,12 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len break; case BLE_VENDOR_CHMAP_UPDATE_EVT: param.vendor_hci_evt.subevt_code = ESP_BLE_VENDOR_CHAN_MAP_UPDATE_EVT; + if (param_len < (UINT8)(1 + 2 + ESP_GAP_BLE_CHANNELS_LEN)) { + BTC_TRACE_WARNING("%s vendor trunc: sub=0x%02x len=%u<%u", + __func__, subevt_code, param_len, (unsigned)(1 + 2 + ESP_GAP_BLE_CHANNELS_LEN)); + parse_ok = false; + break; + } STREAM_TO_UINT8(evt_param->chan_map_update.status, params); STREAM_TO_UINT16(evt_param->chan_map_update.conn_handle, params); REVERSE_STREAM_TO_ARRAY(evt_param->chan_map_update.ch_map, params, ESP_GAP_BLE_CHANNELS_LEN); @@ -1905,6 +1932,17 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len break; } + if (!parse_ok) { + /* Malformed/truncated parameters: keep the mapped esp_ble_vendor_evt_t + * already assigned in the switch (do NOT restore the raw HCI subevent + * code, which is outside esp_ble_vendor_evt_t and would break the + * public API contract). Zero the structured fields and suppress the + * internal raw buffer so the callback delivers a deterministic event; + * the truncation has already been logged above. */ + memset(evt_param, 0, sizeof(*evt_param)); + copy_param = false; + } + if (copy_param) { param.vendor_hci_evt.param_len = param_len; param.vendor_hci_evt.param_buf = (param_len) ? params : NULL; @@ -2138,20 +2176,38 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest; - if (src->cfg_adv_data.adv_data.p_manufacturer_data) { + /* btc_transfer_context() does a shallow memcpy first; always null-out + * pointer fields so deep_free() never frees non-owned memory on OOM. */ + dst->cfg_adv_data.adv_data.p_manufacturer_data = NULL; + dst->cfg_adv_data.adv_data.p_service_data = NULL; + dst->cfg_adv_data.adv_data.p_service_uuid = NULL; + + if (src->cfg_adv_data.adv_data.p_manufacturer_data && src->cfg_adv_data.adv_data.manufacturer_len) { dst->cfg_adv_data.adv_data.p_manufacturer_data = osi_malloc(src->cfg_adv_data.adv_data.manufacturer_len); - memcpy(dst->cfg_adv_data.adv_data.p_manufacturer_data, src->cfg_adv_data.adv_data.p_manufacturer_data, - src->cfg_adv_data.adv_data.manufacturer_len); + if (dst->cfg_adv_data.adv_data.p_manufacturer_data) { + memcpy(dst->cfg_adv_data.adv_data.p_manufacturer_data, src->cfg_adv_data.adv_data.p_manufacturer_data, + src->cfg_adv_data.adv_data.manufacturer_len); + } else { + BTC_TRACE_WARNING("%s no mem, manu drop %u", __func__, src->cfg_adv_data.adv_data.manufacturer_len); + } } - if (src->cfg_adv_data.adv_data.p_service_data) { + if (src->cfg_adv_data.adv_data.p_service_data && src->cfg_adv_data.adv_data.service_data_len) { dst->cfg_adv_data.adv_data.p_service_data = osi_malloc(src->cfg_adv_data.adv_data.service_data_len); - memcpy(dst->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.service_data_len); + if (dst->cfg_adv_data.adv_data.p_service_data) { + memcpy(dst->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.service_data_len); + } else { + BTC_TRACE_WARNING("%s no mem, svc_data drop %u", __func__, src->cfg_adv_data.adv_data.service_data_len); + } } - if (src->cfg_adv_data.adv_data.p_service_uuid) { + if (src->cfg_adv_data.adv_data.p_service_uuid && src->cfg_adv_data.adv_data.service_uuid_len) { dst->cfg_adv_data.adv_data.p_service_uuid = osi_malloc(src->cfg_adv_data.adv_data.service_uuid_len); - memcpy(dst->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.service_uuid_len); + if (dst->cfg_adv_data.adv_data.p_service_uuid) { + memcpy(dst->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.service_uuid_len); + } else { + BTC_TRACE_WARNING("%s no mem, svc_uuid drop %u", __func__, src->cfg_adv_data.adv_data.service_uuid_len); + } } break; } @@ -2159,10 +2215,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest; + dst->cfg_adv_data_raw.raw_adv = NULL; + dst->cfg_adv_data_raw.raw_adv_len = 0; if (src && src->cfg_adv_data_raw.raw_adv && src->cfg_adv_data_raw.raw_adv_len > 0) { dst->cfg_adv_data_raw.raw_adv = osi_malloc(src->cfg_adv_data_raw.raw_adv_len); if (dst->cfg_adv_data_raw.raw_adv) { memcpy(dst->cfg_adv_data_raw.raw_adv, src->cfg_adv_data_raw.raw_adv, src->cfg_adv_data_raw.raw_adv_len); + dst->cfg_adv_data_raw.raw_adv_len = src->cfg_adv_data_raw.raw_adv_len; } } break; @@ -2171,10 +2230,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest; + dst->cfg_scan_rsp_data_raw.raw_scan_rsp = NULL; + dst->cfg_scan_rsp_data_raw.raw_scan_rsp_len = 0; if (src && src->cfg_scan_rsp_data_raw.raw_scan_rsp && src->cfg_scan_rsp_data_raw.raw_scan_rsp_len > 0) { dst->cfg_scan_rsp_data_raw.raw_scan_rsp = osi_malloc(src->cfg_scan_rsp_data_raw.raw_scan_rsp_len); if (dst->cfg_scan_rsp_data_raw.raw_scan_rsp) { memcpy(dst->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp_len); + dst->cfg_scan_rsp_data_raw.raw_scan_rsp_len = src->cfg_scan_rsp_data_raw.raw_scan_rsp_len; } } break; @@ -2185,6 +2247,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest; uint8_t length = 0; + dst->set_security_param.value = NULL; if (src->set_security_param.value) { length = dst->set_security_param.len; dst->set_security_param.value = osi_malloc(length); @@ -2192,6 +2255,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->set_security_param.value, src->set_security_param.value, length); } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + dst->set_security_param.len = 0; } } break; @@ -2200,6 +2264,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest; uint8_t length = 0; + dst->oob_req_reply.p_value = NULL; if (src->oob_req_reply.p_value) { length = dst->oob_req_reply.len; dst->oob_req_reply.p_value = osi_malloc(length); @@ -2207,6 +2272,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->oob_req_reply.p_value, src->oob_req_reply.p_value, length); } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + dst->oob_req_reply.len = 0; } } break; @@ -2214,6 +2280,8 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) case BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT: { btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest; + dst->sc_oob_req_reply.p_c = NULL; + dst->sc_oob_req_reply.p_r = NULL; if (src->sc_oob_req_reply.p_c) { dst->sc_oob_req_reply.p_c = osi_malloc(BT_OCTET16_LEN); if (dst->sc_oob_req_reply.p_c) { @@ -2234,17 +2302,38 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) } #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_50_EXTEND_ADV_EN == TRUE) - case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: - case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: { + case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: { btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src; btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest; uint16_t length = 0; + dst->ext_adv_cfg_data.data = NULL; + dst->ext_adv_cfg_data.length = 0; if (src->ext_adv_cfg_data.data) { length = src->ext_adv_cfg_data.length; dst->ext_adv_cfg_data.data = osi_malloc(length); if (dst->ext_adv_cfg_data.data) { memcpy(dst->ext_adv_cfg_data.data, src->ext_adv_cfg_data.data, length); + dst->ext_adv_cfg_data.length = length; + } else { + BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + } + } + break; + } + case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: { + btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src; + btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest; + uint16_t length = 0; + + dst->cfg_scan_rsp.data = NULL; + dst->cfg_scan_rsp.length = 0; + if (src->cfg_scan_rsp.data) { + length = src->cfg_scan_rsp.length; + dst->cfg_scan_rsp.data = osi_malloc(length); + if (dst->cfg_scan_rsp.data) { + memcpy(dst->cfg_scan_rsp.data, src->cfg_scan_rsp.data, length); + dst->cfg_scan_rsp.length = length; } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } @@ -2258,17 +2347,17 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest; uint16_t length = 0; + dst->periodic_adv_cfg_data.data = NULL; + dst->periodic_adv_cfg_data.len = 0; if (src->periodic_adv_cfg_data.data) { length = src->periodic_adv_cfg_data.len; dst->periodic_adv_cfg_data.data = osi_malloc(length); if (dst->periodic_adv_cfg_data.data) { memcpy(dst->periodic_adv_cfg_data.data, src->periodic_adv_cfg_data.data, length); + dst->periodic_adv_cfg_data.len = length; } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } - } else { - dst->periodic_adv_cfg_data.data = NULL; - dst->periodic_adv_cfg_data.len = 0; } break; } @@ -2306,10 +2395,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT: { btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src; btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest; + dst->vendor_cmd_send.p_param_buf = NULL; + dst->vendor_cmd_send.param_len = 0; if (src->vendor_cmd_send.param_len) { dst->vendor_cmd_send.p_param_buf = osi_malloc(src->vendor_cmd_send.param_len); if (dst->vendor_cmd_send.p_param_buf) { memcpy(dst->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.param_len); + dst->vendor_cmd_send.param_len = src->vendor_cmd_send.param_len; } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } @@ -2396,11 +2488,14 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) switch (msg->act) { case ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT: { + dst->vendor_cmd_cmpl.p_param_buf = NULL; + dst->vendor_cmd_cmpl.param_len = 0; if (src->vendor_cmd_cmpl.param_len) { dst->vendor_cmd_cmpl.p_param_buf = osi_malloc(src->vendor_cmd_cmpl.param_len); if (dst->vendor_cmd_cmpl.p_param_buf) { memcpy(dst->vendor_cmd_cmpl.p_param_buf, src->vendor_cmd_cmpl.p_param_buf, src->vendor_cmd_cmpl.param_len); + dst->vendor_cmd_cmpl.param_len = src->vendor_cmd_cmpl.param_len; } else { BTC_TRACE_ERROR("%s, malloc failed\n", __func__); } @@ -2408,11 +2503,14 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) break; } case ESP_GAP_BLE_VENDOR_HCI_EVT: { + dst->vendor_hci_evt.param_buf = NULL; + dst->vendor_hci_evt.param_len = 0; if (src->vendor_hci_evt.param_len) { dst->vendor_hci_evt.param_buf = osi_malloc(src->vendor_hci_evt.param_len); if (dst->vendor_hci_evt.param_buf) { memcpy(dst->vendor_hci_evt.param_buf, src->vendor_hci_evt.param_buf, src->vendor_hci_evt.param_len); + dst->vendor_hci_evt.param_len = src->vendor_hci_evt.param_len; } else { BTC_TRACE_ERROR("%s, malloc failed\n", __func__); } @@ -2474,7 +2572,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) } } } else { - BTC_TRACE_ERROR("%s, pa_rsp_info, no enough memory.", __func__); + BTC_TRACE_ERROR("%s, step_info, no enough memory.", __func__); } } break; @@ -2497,7 +2595,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) } } } else { - BTC_TRACE_ERROR("%s, pa_rsp_info, no enough memory.", __func__); + BTC_TRACE_ERROR("%s, continue step_info, no enough memory.", __func__); } } break; @@ -2572,14 +2670,20 @@ void btc_gap_ble_arg_deep_free(btc_msg_t *msg) } #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_50_EXTEND_ADV_EN == TRUE) - case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: - case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: { + case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: { uint8_t *value = ((btc_ble_5_gap_args_t *)msg->arg)->ext_adv_cfg_data.data; if (value) { osi_free(value); } break; } + case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: { + uint8_t *value = ((btc_ble_5_gap_args_t *)msg->arg)->cfg_scan_rsp.data; + if (value) { + osi_free(value); + } + break; + } #endif // #if (BLE_50_EXTEND_ADV_EN == TRUE) #if (BLE_50_PERIODIC_ADV_EN == TRUE) case BTC_GAP_BLE_CFG_PERIODIC_ADV_DATA_RAW: { @@ -3031,9 +3135,9 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) break; case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: BTC_TRACE_DEBUG("BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW"); - BTA_DmBleGapConfigExtAdvDataRaw(TRUE, arg_5->ext_adv_cfg_data.instance, - arg_5->ext_adv_cfg_data.length, - (const UINT8 *)arg_5->ext_adv_cfg_data.data); + BTA_DmBleGapConfigExtAdvDataRaw(TRUE, arg_5->cfg_scan_rsp.instance, + arg_5->cfg_scan_rsp.length, + (const UINT8 *)arg_5->cfg_scan_rsp.data); break; case BTC_GAP_BLE_EXT_ADV_START: { BTC_TRACE_DEBUG("BTC_GAP_BLE_EXT_ADV_START"); diff --git a/components/bt/host/bluedroid/stack/btm/btm_acl.c b/components/bt/host/bluedroid/stack/btm/btm_acl.c index 5b7b2618680..890c60aa84e 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_acl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_acl.c @@ -2279,7 +2279,7 @@ void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types) tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda) { tACL_CONN *p; - tBTM_BLE_CH_MAP_RESULTS result; + tBTM_BLE_CH_MAP_RESULTS result = {0}; tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; UINT8 status; @@ -2322,7 +2322,7 @@ void BTM_BleGetWhiteListSize(uint16_t *length) { tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb; if (p_cb->white_list_avail_size == 0) { - BTM_TRACE_WARNING("%s Whitelist full.", __func__); + BTM_TRACE_WARNING("%s Whitelist size is 0.", __func__); } *length = p_cb->white_list_avail_size; return; @@ -2356,7 +2356,7 @@ void BTM_BleGetPeriodicAdvListSize(uint8_t *size) *******************************************************************************/ void btm_read_channel_map_complete(UINT8 *p) { - tBTM_BLE_CH_MAP_RESULTS results; + tBTM_BLE_CH_MAP_RESULTS results = {0}; UINT16 handle; tACL_CONN *p_acl_cb = NULL; diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble.c b/components/bt/host/bluedroid/stack/btm/btm_ble.c index 95b44c35889..23ddc7b99d5 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble.c @@ -736,7 +736,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT tran ** p_cmd_cmpl_cback - Command Complete callback ** *******************************************************************************/ -void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback) +void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback) { btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback; @@ -758,7 +758,7 @@ void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback) ** *******************************************************************************/ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, - UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback) + UINT8 packet_payload, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback) { btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback; if (btsnd_hcic_ble_transmitter_test(tx_freq, test_data_len, packet_payload) == FALSE) { @@ -776,7 +776,7 @@ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, ** Parameter p_cmd_cmpl_cback - Command complete callback ** *******************************************************************************/ -void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback) +void BTM_BleTestEnd(tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback) { btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback; @@ -788,14 +788,14 @@ void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback) /******************************************************************************* ** Internal Functions *******************************************************************************/ -void btm_ble_test_command_complete(UINT8 *p) +void btm_ble_test_command_complete(UINT8 *p, UINT16 len) { - tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb; + tBTM_DTM_CMD_CMPL_CBACK *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb; btm_cb.devcb.p_le_test_cmd_cmpl_cb = NULL; if (p_cb) { - (*p_cb)(p); + (*p_cb)(p, len); } } #endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE)) @@ -813,7 +813,7 @@ void btm_ble_test_command_complete(UINT8 *p) ** p_cmd_cmpl_cback - Command Complete callback ** *******************************************************************************/ -void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback) +void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback) { btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback; @@ -836,7 +836,7 @@ void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_inde ** *******************************************************************************/ void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, - UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback) + UINT8 packet_payload, UINT8 phy, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback) { btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback; if (btsnd_hcic_ble_enhand_tx_test(tx_freq, test_data_len, packet_payload, phy) == FALSE) { diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c index 40498baddc3..e15cae411b1 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c @@ -334,13 +334,13 @@ tBTM_STATUS BTM_BleConfigExtendedAdvDataRaw(BOOLEAN is_scan_rsp, UINT8 instance, } } if (!is_scan_rsp) { - if ((err = btsnd_hcic_ble_set_ext_adv_data(instance, operation, 0, send_data_len, &data[data_offset])) != HCI_SUCCESS) { + if ((err = btsnd_hcic_ble_set_ext_adv_data(instance, operation, 0, send_data_len, (data == NULL) ? NULL : &data[data_offset])) != HCI_SUCCESS) { BTM_TRACE_ERROR("LE EA SetAdvData: cmd err=0x%x", err); status = BTM_HCI_ERROR | err; break; } } else { - if ((err = btsnd_hcic_ble_set_ext_adv_scan_rsp_data(instance, operation, 0, send_data_len, &data[data_offset])) != HCI_SUCCESS) { + if ((err = btsnd_hcic_ble_set_ext_adv_scan_rsp_data(instance, operation, 0, send_data_len, (data == NULL) ? NULL : &data[data_offset])) != HCI_SUCCESS) { BTM_TRACE_ERROR("LE EA SetScanRspData: cmd err=0x%x", err); status = BTM_HCI_ERROR | err; break; @@ -1900,7 +1900,6 @@ void btm_ble_cs_read_local_supp_caps_cmpl_evt(uint8_t *p) goto _error; } - STREAM_TO_UINT16(cb_params.cs_read_local_supp_caps.conn_handle, p); STREAM_TO_UINT8(cb_params.cs_read_local_supp_caps.num_config_supported, p); STREAM_TO_UINT16(cb_params.cs_read_local_supp_caps.max_consecutive_proc_supported, p); STREAM_TO_UINT8(cb_params.cs_read_local_supp_caps.num_ant_supported, p); @@ -2011,6 +2010,7 @@ void btm_ble_cs_read_remote_fae_table_cmd_status(UINT8 status) tBTM_BLE_CS_READ_REMOTE_FAE_TAB_CMPL_EVT cs_read_remote_fae_tab = {0}; if (status != HCI_SUCCESS) { cs_read_remote_fae_tab.status = (status | BTM_HCI_ERROR); + cs_read_remote_fae_tab.conn_handle = 0xFFFF; BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_CS_READ_REMOTE_FAE_TABLE_CMPL_EVT, (tBTM_BLE_5_GAP_CB_PARAMS *)&cs_read_remote_fae_tab); } } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c b/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c index 45f3af5bcd3..2a3fab1b09b 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c @@ -1180,6 +1180,9 @@ void btm_ble_resolving_list_cleanup(void) { tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q; + p_q->q_next = 0; + p_q->q_pending = 0; + if (p_q->resolve_q_random_pseudo) { osi_free(p_q->resolve_q_random_pseudo); p_q->resolve_q_random_pseudo = NULL; diff --git a/components/bt/host/bluedroid/stack/btm/btm_devctl.c b/components/bt/host/bluedroid/stack/btm/btm_devctl.c index 859cadeecb1..1f2ae073cb0 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_devctl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_devctl.c @@ -120,13 +120,11 @@ void btm_dev_init (void) *******************************************************************************/ static void btm_db_reset (void) { - tBTM_CMPL_CB *p_cb; - tBTM_STATUS status = BTM_DEV_RESET; - btm_inq_db_reset(); #if (CLASSIC_BT_INCLUDED == TRUE) if (btm_cb.devcb.p_rln_cmpl_cb) { + tBTM_CMPL_CB *p_cb; p_cb = btm_cb.devcb.p_rln_cmpl_cb; btm_cb.devcb.p_rln_cmpl_cb = NULL; @@ -137,12 +135,14 @@ static void btm_db_reset (void) #endif // (CLASSIC_BT_INCLUDED == TRUE) if (btm_cb.devcb.p_rssi_cmpl_cb) { - p_cb = btm_cb.devcb.p_rssi_cmpl_cb; - btm_cb.devcb.p_rssi_cmpl_cb = NULL; + tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_rssi_cmpl_cb; + tBTM_RSSI_RESULTS results = {0}; - if (p_cb) { - (*p_cb)((tBTM_RSSI_RESULTS *) &status); - } + results.status = BTM_DEV_RESET; + btm_cb.devcb.p_rssi_cmpl_cb = NULL; + btu_stop_timer(&btm_cb.devcb.rssi_timer); + + (*p_cb)(&results); } } diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h index 02fa86b47e2..3ecd7cb16f0 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h @@ -444,7 +444,7 @@ void btm_ble_increment_sign_ctr(BD_ADDR bd_addr, BOOLEAN is_local ); BOOLEAN btm_get_local_div (BD_ADDR bd_addr, UINT16 *p_div); BOOLEAN btm_ble_get_enc_key_type(BD_ADDR bd_addr, UINT8 *p_key_types); -void btm_ble_test_command_complete(UINT8 *p); +void btm_ble_test_command_complete(UINT8 *p, UINT16 len); void btm_ble_rand_enc_complete (UINT8 *p, UINT16 op_code, tBTM_RAND_ENC_CB *p_enc_cplt_cback); void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY_VALUE *p_keys, BOOLEAN pass_to_application); diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_int.h index 1a285f2ba73..f9f3f16ed3b 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_int.h @@ -289,8 +289,8 @@ DEV_CLASS dev_class; /* Local device class TIMER_LIST_ENT ble_channels_timer; -tBTM_CMPL_CB *p_le_test_cmd_cmpl_cb; /* Callback function to be called when - LE test mode command has been sent successfully */ +tBTM_DTM_CMD_CMPL_CBACK *p_le_test_cmd_cmpl_cb; /* Callback function to be called when + LE test mode command has been sent successfully */ BD_ADDR read_tx_pwr_addr; /* read TX power target address */ diff --git a/components/bt/host/bluedroid/stack/include/stack/btm_api.h b/components/bt/host/bluedroid/stack/include/stack/btm_api.h index c7ecfed3454..663cbe250a2 100644 --- a/components/bt/host/bluedroid/stack/include/stack/btm_api.h +++ b/components/bt/host/bluedroid/stack/include/stack/btm_api.h @@ -173,7 +173,14 @@ typedef void (tBTM_VSC_CMPL_CB) (tBTM_VSC_CMPL *p1); */ // typedef UINT8 (tBTM_FILTER_CB) (BD_ADDR bd_addr, DEV_CLASS dc); -typedef void (tBTM_DTM_CMD_CMPL_CBACK) (void *p1); +/* + * DTM (Direct Test Mode) command complete callback. + * + * The controller returns a variable-length parameter block depending on the + * specific LE test command. Propagate the parameter length so upper layers can + * validate before parsing and avoid OOB reads on malformed/truncated responses. + */ +typedef void (tBTM_DTM_CMD_CMPL_CBACK) (UINT8 *p, UINT16 len); typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status); diff --git a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h index 6084ffa6afa..7b17ba89314 100644 --- a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h +++ b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h @@ -1528,7 +1528,6 @@ typedef struct { typedef struct { UINT8 status; - UINT16 conn_handle; UINT8 num_config_supported; UINT16 max_consecutive_proc_supported; UINT8 num_ant_supported; @@ -2726,7 +2725,7 @@ void BTM_BleClearWhitelist(void); ** p_cmd_cmpl_cback - Command Complete callback ** *******************************************************************************/ -void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback); +void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback); /******************************************************************************* @@ -2742,7 +2741,7 @@ void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback); ** *******************************************************************************/ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, - UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback); + UINT8 packet_payload, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback); /******************************************************************************* ** @@ -2753,7 +2752,7 @@ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, ** Parameter p_cmd_cmpl_cback - Command complete callback ** *******************************************************************************/ -void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback); +void BTM_BleTestEnd(tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback); /******************************************************************************* ** @@ -3087,9 +3086,9 @@ tBTM_STATUS BTM_BleEnableMonitorAdv(UINT8 enable); #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_50_DTM_TEST_EN == TRUE) -void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback); +void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback); -void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback); +void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback); #endif // #if (BLE_50_DTM_TEST_EN == TRUE) #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)