Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(nimble): Fix vulnerabilities in NimBLE examples

Browse Source
This commit is contained in:
Shreeyash
2026-02-19 10:18:38 +05:30
committed by Rahul Tank
parent 1a2b081be3
commit ba1360baef
43 changed files with 872 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/bluetooth/nimble/bleprph_host_only/main/main.c
+4 -1
View File
@@ -245,7 +245,9 @@ bleprph_gap_event(struct ble_gap_event *event, void *arg)
}
#if MYNEWT_VAL(BLE_POWER_CONTROL)
bleprph_power_control(event->connect.conn_handle);
if (event->connect.status == 0) {
bleprph_power_control(event->connect.conn_handle);
}
#endif
return 0;
@@ -497,6 +499,7 @@ app_main(void)
ret = nimble_port_init();
if (ret != ESP_OK) {
ESP_LOGE(tag, "Failed to init nimble %d ", ret);
hci_uart_close();
return;
}
/* Initialize the NimBLE host configuration. */
examples/bluetooth/nimble/bleprph_host_only/main/uart_driver.c
+38 -6
View File
@@ -1,11 +1,12 @@
/*
* SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Unlicense OR CC0-1.0
*/
#include <stdio.h>
#include <string.h>
#include <stdbool.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "freertos/queue.h"
@@ -44,6 +45,7 @@ enum {
};
TaskHandle_t s_rx_task_hdl;
static volatile bool s_shutdown_flag = false;
static void IRAM_ATTR hci_uart_rx_task(void *arg)
{
@@ -53,9 +55,15 @@ static void IRAM_ATTR hci_uart_rx_task(void *arg)
uint32_t len_total_read = 0;
uint8_t rx_st = UART_RX_TYPE;
while (1) {
len_now_read = uart_read_bytes(UART_NO, &buf[len_total_read], len_to_read, portMAX_DELAY);
assert(len_now_read == len_to_read);
while (!s_shutdown_flag) {
// Use timeout instead of portMAX_DELAY to allow periodic shutdown flag check
len_now_read = uart_read_bytes(UART_NO, &buf[len_total_read], len_to_read, pdMS_TO_TICKS(100));
// If timeout occurred, continue loop to check shutdown flag again
if (len_now_read == 0) {
continue;
}
len_total_read += len_now_read;
switch (rx_st) {
@@ -130,6 +138,10 @@ static void IRAM_ATTR hci_uart_rx_task(void *arg)
m = ble_transport_alloc_acl_from_ll();
if (!m) {
ESP_LOGE(TAG, "No buffers");
rx_st = UART_RX_TYPE;
len_to_read = 1;
len_total_read = 0;
break;
}
if ((rc = os_mbuf_append(m, &data[1], len_total_read - 1)) != 0) {
@@ -180,7 +192,7 @@ ble_transport_ll_init(void)
void
ble_transport_ll_deinit(void)
{
hci_uart_close();
}
int
@@ -228,6 +240,7 @@ void hci_uart_open(void)
intr_alloc_flags = ESP_INTR_FLAG_IRAM;
#endif
s_shutdown_flag = false; // Reset shutdown flag on open
ESP_ERROR_CHECK(uart_driver_install(UART_NO, UART_BUF_SZ * 2, UART_BUF_SZ * 2, 0, NULL, intr_alloc_flags));
ESP_ERROR_CHECK(uart_param_config(UART_NO, &uart_config));
ESP_ERROR_CHECK(uart_set_pin(UART_NO, UART_TX_PIN, UART_RX_PIN, -1, -1));
@@ -238,7 +251,26 @@ void hci_uart_open(void)
void hci_uart_close(void)
{
if (s_rx_task_hdl) {
vTaskDelete(s_rx_task_hdl);
s_shutdown_flag = true;
int wait_count = 0;
const int max_wait_count = 5;
TaskHandle_t task_handle = s_rx_task_hdl;
while (wait_count < max_wait_count) {
vTaskDelay(pdMS_TO_TICKS(100));
wait_count++;
}
if (s_rx_task_hdl == task_handle) {
vTaskDelete(s_rx_task_hdl);
vTaskDelay(pdMS_TO_TICKS(100));
}
s_rx_task_hdl = NULL;
}
uart_driver_delete(UART_NO);
}