diff --git a/components/bt/host/bluedroid/stack/btm/btm_acl.c b/components/bt/host/bluedroid/stack/btm/btm_acl.c index 6187d3cb8fd..6d53ba49b04 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_acl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_acl.c @@ -362,128 +362,131 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L } else { p = (tACL_CONN *)osi_malloc(sizeof(tACL_CONN)); - if (p && !list_append(btm_cb.p_acl_db_list, p)) { + if (p == NULL) { + BTM_TRACE_ERROR("btm_acl_created: osi_malloc failed for tACL_CONN\n"); + return; + } + if (!list_append(btm_cb.p_acl_db_list, p)) { + BTM_TRACE_ERROR("btm_acl_created: list_append failed\n"); osi_free(p); return; } - if (p) { - memset(p, 0, sizeof(tACL_CONN)); - p->in_use = TRUE; - p->hci_handle = hci_handle; - p->link_role = link_role; - p->link_up_issued = FALSE; - memcpy (p->remote_addr, bda, BD_ADDR_LEN); - /* Set the default version of the peer device to version4.0 before exchange the version with it. - If the peer device act as a master and don't exchange the version with us, then it can only use the - legacy connect instead of secure connection in the pairing step. */ - p->lmp_version = HCI_PROTO_VERSION_4_0; + memset(p, 0, sizeof(tACL_CONN)); + p->in_use = TRUE; + p->hci_handle = hci_handle; + p->link_role = link_role; + p->link_up_issued = FALSE; + memcpy (p->remote_addr, bda, BD_ADDR_LEN); + /* Set the default version of the peer device to version4.0 before exchange the version with it. + If the peer device act as a master and don't exchange the version with us, then it can only use the + legacy connect instead of secure connection in the pairing step. */ + p->lmp_version = HCI_PROTO_VERSION_4_0; #if BLE_INCLUDED == TRUE - p->transport = transport; + p->transport = transport; #if BLE_PRIVACY_SPT == TRUE - if (transport == BT_TRANSPORT_LE) { - btm_ble_refresh_local_resolvable_private_addr(bda, - btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr); - } + if (transport == BT_TRANSPORT_LE) { + btm_ble_refresh_local_resolvable_private_addr(bda, + btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr); + } #else - p->conn_addr_type = BLE_ADDR_PUBLIC; - memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN); - BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n", - p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]); + p->conn_addr_type = BLE_ADDR_PUBLIC; + memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN); + BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n", + p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]); #endif #endif #if (CLASSIC_BT_INCLUDED == TRUE) - p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE; + p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE; - p->p_pm_mode_db = btm_pm_sm_alloc(); + p->p_pm_mode_db = btm_pm_sm_alloc(); #if BTM_PM_DEBUG == TRUE - BTM_TRACE_DEBUG( "btm_pm_sm_alloc handle:%d st:%d", hci_handle, p->p_pm_mode_db->state); + BTM_TRACE_DEBUG( "btm_pm_sm_alloc handle:%d st:%d", hci_handle, p->p_pm_mode_db->state); #endif // BTM_PM_DEBUG #endif // (CLASSIC_BT_INCLUDED == TRUE) #if (CLASSIC_BT_INCLUDED == TRUE) - btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE); + btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE); #endif - if (dc) { - memcpy (p->remote_dc, dc, DEV_CLASS_LEN); - } + if (dc) { + memcpy (p->remote_dc, dc, DEV_CLASS_LEN); + } - if (bdn) { - memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN); - } + if (bdn) { + memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN); + } - /* if BR/EDR do something more */ - if (transport == BT_TRANSPORT_BR_EDR) { - btsnd_hcic_read_rmt_clk_offset (p->hci_handle); - btsnd_hcic_rmt_ver_req (p->hci_handle); - } - p_dev_rec = btm_find_dev_by_handle (hci_handle); + /* if BR/EDR do something more */ + if (transport == BT_TRANSPORT_BR_EDR) { + btsnd_hcic_read_rmt_clk_offset (p->hci_handle); + btsnd_hcic_rmt_ver_req (p->hci_handle); + } + p_dev_rec = btm_find_dev_by_handle (hci_handle); #if (BLE_INCLUDED == TRUE) - if (p_dev_rec ) { - BTM_TRACE_DEBUG ("device_type=0x%x\n", p_dev_rec->device_type); - } + if (p_dev_rec ) { + BTM_TRACE_DEBUG ("device_type=0x%x\n", p_dev_rec->device_type); + } #endif - if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) { - if (!p_dev_rec->remote_secure_connection_previous_state) { - /* If remote features already known, copy them and continue connection setup */ - if ((p_dev_rec->num_read_pages) && - (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) { - memcpy (p->peer_lmp_features, p_dev_rec->features, - (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages)); - p->num_read_pages = p_dev_rec->num_read_pages; + if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) { + if (!p_dev_rec->remote_secure_connection_previous_state) { + /* If remote features already known, copy them and continue connection setup */ + if ((p_dev_rec->num_read_pages) && + (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) { + memcpy (p->peer_lmp_features, p_dev_rec->features, + (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages)); + p->num_read_pages = p_dev_rec->num_read_pages; #if (CLASSIC_BT_INCLUDED == TRUE) - const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND); + const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND); #endif ///CLASSIC_BT_INCLUDED == TRUE - /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */ + /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */ #if (SMP_INCLUDED == TRUE) - btm_sec_set_peer_sec_caps(p, p_dev_rec); + btm_sec_set_peer_sec_caps(p, p_dev_rec); #endif ///SMP_INCLUDED == TRUE #if (CLASSIC_BT_INCLUDED == TRUE) - BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend); - if (req_pend) { - /* Request for remaining Security Features (if any) */ - l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr); - } -#endif ///CLASSIC_BT_INCLUDED == TRUE - btm_establish_continue (p); - return; + BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend); + if (req_pend) { + /* Request for remaining Security Features (if any) */ + l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr); } - } else { - /* If remote features indicated secure connection (SC) mode, check the remote features again*/ - /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/ - btm_read_remote_features (p->hci_handle); +#endif ///CLASSIC_BT_INCLUDED == TRUE + btm_establish_continue (p); + return; } - } - -#if (BLE_INCLUDED == TRUE) - /* If here, features are not known yet */ - if (p_dev_rec && transport == BT_TRANSPORT_LE) { -#if BLE_PRIVACY_SPT == TRUE - btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr, - &p->active_remote_addr_type); -#endif - - if (link_role == HCI_ROLE_MASTER) { - btsnd_hcic_ble_read_remote_feat(p->hci_handle); - } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array) - && link_role == HCI_ROLE_SLAVE) { - btsnd_hcic_rmt_ver_req (p->hci_handle); - } else { - btm_establish_continue(p); - } - } else -#endif - { + } else { + /* If remote features indicated secure connection (SC) mode, check the remote features again*/ + /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/ btm_read_remote_features (p->hci_handle); } - - /* read page 1 - on rmt feature event for buffer reasons */ - return; } + +#if (BLE_INCLUDED == TRUE) + /* If here, features are not known yet */ + if (p_dev_rec && transport == BT_TRANSPORT_LE) { +#if BLE_PRIVACY_SPT == TRUE + btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr, + &p->active_remote_addr_type); +#endif + + if (link_role == HCI_ROLE_MASTER) { + btsnd_hcic_ble_read_remote_feat(p->hci_handle); + } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array) + && link_role == HCI_ROLE_SLAVE) { + btsnd_hcic_rmt_ver_req (p->hci_handle); + } else { + btm_establish_continue(p); + } + } else +#endif + { + btm_read_remote_features (p->hci_handle); + } + + /* read page 1 - on rmt feature event for buffer reasons */ + return; } } @@ -593,11 +596,9 @@ void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport) #if (CLASSIC_BT_INCLUDED == TRUE) list_remove(btm_cb.p_pm_mode_db_list, p->p_pm_mode_db); #endif // #if (CLASSIC_BT_INCLUDED == TRUE) - /* Clear the ACL connection data */ - memset(p, 0, sizeof(tACL_CONN)); - if (list_remove(btm_cb.p_acl_db_list, p)) { - p = NULL; - } + /* Remove and free the ACL connection data */ + list_remove(btm_cb.p_acl_db_list, p); + p = NULL; } } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble.c b/components/bt/host/bluedroid/stack/btm/btm_ble.c index 7ea143e7561..5a35fa0e9b8 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble.c @@ -2173,9 +2173,7 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data) case SMP_OOB_REQ_EVT: case SMP_NC_REQ_EVT: case SMP_SC_OOB_REQ_EVT: - /* fall through */ - p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED; - + /* fall through */ case SMP_SEC_REQUEST_EVT: if (event == SMP_SEC_REQUEST_EVT && btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) { BTM_TRACE_DEBUG("%s: Ignoring SMP Security request", __func__); diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c index 3ecfe99c696..089f7758e1e 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c @@ -203,8 +203,6 @@ static const char *btm_ble_hci_status_to_str(tHCI_STATUS status) default: return "Invalid HCI status code."; } - - return NULL; } #endif /* !UC_BT_STACK_NO_LOG */ @@ -384,6 +382,7 @@ tBTM_STATUS BTM_BleSetExtendedAdvParams(UINT8 instance, tBTM_BLE_GAP_EXT_ADV_PAR if ((status = btm_ble_ext_adv_params_validate(params)) != BTM_SUCCESS) { BTM_TRACE_ERROR("%s, invalid extend adv params.", __func__); + goto end; } if (params->type & BTM_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE) { @@ -567,10 +566,6 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_ BTM_TRACE_ERROR("LE EA En=%d: cmd err=0x%x", enable, err); status = BTM_HCI_ERROR | err; } - - osi_free(instance); - osi_free(duration); - osi_free(max_events); } else { // enable = false, num == 0 or ext_adv = NULL @@ -584,6 +579,15 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_ end: + if (instance) { + osi_free(instance); + } + if (duration) { + osi_free(duration); + } + if (max_events) { + osi_free(max_events); + } if (!enable && status == BTM_SUCCESS) { // disable all ext adv @@ -602,6 +606,9 @@ end: for (uint8_t i = 0; i < num; i++) { uint8_t index = ext_adv[i].instance; + if (index >= MAX_BLE_ADV_INSTANCE) { + continue; + } adv_record[index].invalid = false; adv_record[index].enabled = false; adv_record[index].instance = INVALID_VALUE_8BIT; @@ -616,6 +623,9 @@ end: for (uint8_t i = 0; i < num; i++) { uint8_t index = ext_adv[i].instance; + if (index >= MAX_BLE_ADV_INSTANCE) { + continue; + } adv_record[index].invalid = true; adv_record[index].enabled = true; adv_record[index].instance = ext_adv[i].instance; diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c b/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c index 7d8c3b0b933..15bb8b4daa9 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c @@ -441,12 +441,12 @@ tBTM_SEC_DEV_REC *btm_find_dev_by_identity_addr(BD_ADDR bd_addr, UINT8 addr_type context.free_check = FALSE; p_node = list_foreach(btm_cb.p_sec_dev_rec_list, btm_find_sec_dev_in_list, &context); if (p_node) { - p_dev_rec = list_node(p_node); + p_dev_rec = list_node(p_node); if ((p_dev_rec->ble.static_addr_type & (~BLE_ADDR_TYPE_ID_BIT)) != (addr_type & (~BLE_ADDR_TYPE_ID_BIT))) { BTM_TRACE_WARNING("%s find pseudo->random match with diff addr type: %d vs %d", __func__, p_dev_rec->ble.static_addr_type, addr_type); - } + } } return p_dev_rec; #endif diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c index 90461db35ca..51973d310ed 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c @@ -1979,7 +1979,7 @@ UINT8 *btm_ble_build_adv_data(tBTM_BLE_AD_MASK *p_data_mask, UINT8 **p_dst, } /* 16bits/32bits/128bits Service Data */ if (len > MIN_ADV_LENGTH && data_mask & BTM_BLE_AD_BIT_SERVICE_DATA && - p_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) { + p_data && p_data->p_service_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) { if (len > (p_data->p_service_data->service_uuid.len + MIN_ADV_LENGTH)) { if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH)) { cp_len = len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len; @@ -3063,7 +3063,7 @@ static void btm_adv_pkt_handler(void *arg) STREAM_TO_UINT8 (hci_evt_len, p); STREAM_TO_UINT8 (ble_sub_code, p); if (ble_sub_code == HCI_BLE_ADV_PKT_RPT_EVT) { - btm_ble_process_adv_pkt(p); + btm_ble_process_adv_pkt(p, hci_evt_len); } else if (ble_sub_code == HCI_BLE_ADV_DISCARD_REPORT_EVT) { btm_ble_process_adv_discard_evt(p); } else if (ble_sub_code == HCI_BLE_DIRECT_ADV_EVT) { @@ -3083,7 +3083,6 @@ static void btm_adv_pkt_handler(void *arg) } UNUSED(hci_evt_code); - UNUSED(hci_evt_len); } /******************************************************************************* @@ -3099,7 +3098,7 @@ static void btm_adv_pkt_handler(void *arg) ** Returns void ** *******************************************************************************/ -void btm_ble_process_adv_pkt (UINT8 *p_data) +void btm_ble_process_adv_pkt (UINT8 *p_data, UINT8 evt_len) { BD_ADDR bda; UINT8 evt_type = 0, *p = p_data; @@ -3119,10 +3118,22 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) return; } + /* sub_code(1) already consumed by caller, need at least num_reports(1) */ + if (evt_len < 2) { + BTM_TRACE_ERROR("btm_ble_process_adv_pkt: evt too short (len=%u)", evt_len); + return; + } + /* Extract the number of reports in this event. */ STREAM_TO_UINT8(num_reports, p); + UINT8 remaining = evt_len - 2; while (num_reports--) { + /* Per-report minimum: evt_type(1) + addr_type(1) + bda(6) + data_len(1) + rssi(1) = 10 */ + if (remaining < 10) { + BTM_TRACE_ERROR("btm_ble_process_adv_pkt: remaining %u too short for report", remaining); + break; + } #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) /* Save current report start position for address resolution callback */ UINT8 *pp = p; @@ -3131,8 +3142,6 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) STREAM_TO_UINT8 (evt_type, p); STREAM_TO_UINT8 (addr_type, p); STREAM_TO_BDADDR (bda, p); - //BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n", - // bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]); #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) #if (!CONTROLLER_RPA_LIST_ENABLE) @@ -3142,17 +3151,21 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) /* map address to security record */ match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE); - - // BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n", - // bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]); - /* always do RRA resolution on host */ +#endif + /* Validate data_len before any path (callee reads 1 + data_len + 1 = data_len+2 bytes from p) */ + data_len = *p; /* read without advancing; p points to data_len byte */ + if (data_len + 2 > remaining - 8) { + BTM_TRACE_ERROR("btm_ble_process_adv_pkt: data_len %u + data + rssi exceeds remaining %u", data_len, (UINT16)(remaining - 8)); + break; + } +#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) + /* RRA path: resolve first, btm_ble_process_adv_pkt_cont will be called from callback; else process now */ if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) { btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, pp); } else #endif btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p); #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE && (!CONTROLLER_RPA_LIST_ENABLE)) - //save current adv addr information if p_dev_rec!= NULL tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda); if(p_dev_rec) { p_dev_rec->ble.current_addr_type = temp_addr_type; @@ -3161,9 +3174,11 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) } #endif STREAM_TO_UINT8(data_len, p); + remaining -= 9; /* evt_type(1) + addr_type(1) + bda(6) + data_len(1) */ /* Advance to the next event data_len + rssi byte */ p += data_len + 1; + remaining -= (data_len + 1); } } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c b/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c index 49483702a88..947c920bffc 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c @@ -46,7 +46,7 @@ void btm_ble_iso_read_iso_tx_sync_complete(UINT8 *p) if (cb_params.btm_read_tx_sync.status != HCI_SUCCESS) { cb_params.btm_read_tx_sync.status = (BTM_HCI_ERROR | cb_params.btm_read_tx_sync.status); } - cb_params.btm_read_tx_sync.conn_hdl = (cb_params.btm_read_tx_sync.conn_hdl & 0xEFF); + cb_params.btm_read_tx_sync.conn_hdl = (cb_params.btm_read_tx_sync.conn_hdl & 0x0FFF); cb_params.btm_read_tx_sync.time_offset = (cb_params.btm_read_tx_sync.time_offset & 0xFFFFFF); BTM_TRACE_DEBUG("read tx sync cmpl, status 0x%x conn_hdl 0x%x pkt_seq_num %d tx_time_stamp %ld time_offset %ld\n", cb_params.btm_read_tx_sync.status, cb_params.btm_read_tx_sync.conn_hdl, cb_params.btm_read_tx_sync.pkt_seq_num, diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c b/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c index 09a0835f6a0..72dbebd24bd 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c @@ -49,6 +49,7 @@ #define BTM_BLE_META_CLEAR_IRK_LEN 1 #define BTM_BLE_META_READ_IRK_LEN 2 #define BTM_BLE_META_ADD_WL_ATTR_LEN 9 +#define BTM_BLE_IRK_LIST_INVALID_INDEX 0xFF #if CONTROLLER_RPA_LIST_ENABLE && BLE_SMP_ID_RESET_ENABLE static bool is_deleting_zero_addr; @@ -166,7 +167,7 @@ void btm_ble_clear_irk_index(UINT8 index) ** ** Description find the first available IRK list index ** -** Returns index from 0 ~ max (127 default) +** Returns index from 0 ~ max-1, or BTM_BLE_IRK_LIST_INVALID_INDEX if full ** *******************************************************************************/ UINT8 btm_ble_find_irk_index(void) @@ -187,7 +188,7 @@ UINT8 btm_ble_find_irk_index(void) } BTM_TRACE_ERROR ("%s failed, list full", __func__); - return i; + return BTM_BLE_IRK_LIST_INVALID_INDEX; } /******************************************************************************* @@ -209,7 +210,13 @@ void btm_ble_update_resolving_list(BD_ADDR pseudo_bda, BOOLEAN add) if (add) { p_dev_rec->ble.in_controller_list |= BTM_RESOLVING_LIST_BIT; if (!controller_get_interface()->supports_ble_privacy()) { - p_dev_rec->ble.resolving_list_index = btm_ble_find_irk_index(); + UINT8 irk_index = btm_ble_find_irk_index(); + if (irk_index != BTM_BLE_IRK_LIST_INVALID_INDEX) { + p_dev_rec->ble.resolving_list_index = irk_index; + } else { + p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT; + BTM_TRACE_WARNING("%s: IRK list full, cannot add to resolving list", __func__); + } } } else { p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT; diff --git a/components/bt/host/bluedroid/stack/btm/btm_devctl.c b/components/bt/host/bluedroid/stack/btm/btm_devctl.c index 057eba2dbbc..4b70ca1c605 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_devctl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_devctl.c @@ -780,8 +780,8 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len, if(ble_cb && ble_cb->update_exceptional_list_cmp_cb) { (*ble_cb->update_exceptional_list_cmp_cb)(status, subcode, length, p); } - break; #endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) + break; } case HCI_VENDOR_BLE_CLEAR_ADV: { uint8_t status; diff --git a/components/bt/host/bluedroid/stack/btm/btm_sco.c b/components/bt/host/bluedroid/stack/btm/btm_sco.c index 6964028000d..a9a2d76f46f 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_sco.c +++ b/components/bt/host/bluedroid/stack/btm/btm_sco.c @@ -322,7 +322,7 @@ void btm_sco_check_send_pkts (UINT16 sco_inx) } } -void btm_sco_process_num_completed_pkts (UINT8 *p) +void btm_sco_process_num_completed_pkts (UINT8 *p, UINT8 evt_len) { UINT8 num_handles, xx; UINT16 handle; @@ -330,7 +330,20 @@ void btm_sco_process_num_completed_pkts (UINT8 *p) UINT16 sco_inx; tSCO_CB *p_cb = &btm_cb.sco_cb; tSCO_CONN * p_ccb; + + if (evt_len < 1) { + BTM_TRACE_ERROR ("btm_sco_process_num_completed_pkts: evt too short (len=%u)", evt_len); + return; + } + STREAM_TO_UINT8 (num_handles, p); + + if (num_handles > (evt_len - 1) / 4) { + BTM_TRACE_ERROR ("btm_sco_process_num_completed_pkts: num_handles %u exceeds evt_len %u, truncating", + num_handles, evt_len); + num_handles = (evt_len - 1) / 4; + } + for (xx = 0; xx < num_handles; xx++) { STREAM_TO_UINT16 (handle, p); STREAM_TO_UINT16 (num_sent, p); diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h index 06a20235990..9340c81dd8e 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h @@ -401,7 +401,7 @@ extern "C" { void btm_ble_timeout(TIMER_LIST_ENT *p_tle); #if (BLE_42_SCAN_EN == TRUE) -void btm_ble_process_adv_pkt (UINT8 *p); +void btm_ble_process_adv_pkt (UINT8 *p, UINT8 evt_len); void btm_ble_process_adv_discard_evt(UINT8 *p); void btm_ble_process_direct_adv_pkt (UINT8 *p); bool btm_ble_adv_pkt_ready(void); diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_int.h index e3e8c816bd1..6c13beaa50a 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_int.h @@ -1192,7 +1192,7 @@ void btm_pm_proc_ssr_evt (UINT8 *p, UINT16 evt_len); void btm_sco_chk_pend_unpark (UINT8 hci_status, UINT16 hci_handle); #if (BTM_SCO_HCI_INCLUDED == TRUE ) void btm_sco_process_num_bufs (UINT16 num_lm_sco_bufs); -void btm_sco_process_num_completed_pkts (UINT8 *p); +void btm_sco_process_num_completed_pkts (UINT8 *p, UINT8 evt_len); #endif /* (BTM_SCO_HCI_INCLUDED == TRUE ) */ #else #define btm_sco_chk_pend_unpark(hci_status, hci_handle)