Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/ai_review_a2dp_v5.4' into 'release/v5.4'

Browse Source 
fix(bt): Fix the critical issues related to A2DP from AI review report (v5.4)

See merge request espressif/esp-idf!50130
This commit is contained in:
Wang Meng Yang
2026-06-30 19:23:54 +08:00
parent 582e0d5c1d f164a75569
commit d3d0963239
11 changed files with 45 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/avdt/avdt_ad.c
+5
View File
@@ -110,6 +110,11 @@ void avdt_ad_init(void)
tAVDT_TC_TBL *p_tbl = avdt_cb.ad.tc_tbl;
memset(&avdt_cb.ad, 0, sizeof(tAVDT_AD));
/* 0 is a valid tc_tbl index; use invalid marker for unassigned LCIDs */
for (i = 0; i < MAX_L2CAP_CHANNELS; i++) {
avdt_cb.ad.lcid_tbl[i] = 0xFF;
}
/* make sure the peer_mtu is a valid value */
for (i = 0; i < AVDT_NUM_TC_TBL; i++, p_tbl++) {
p_tbl->peer_mtu = L2CAP_DEFAULT_MTU;
components/bt/host/bluedroid/stack/avdt/avdt_api.c
+1
View File
@@ -909,6 +909,7 @@ UINT16 AVDT_WriteReqOpt(UINT8 handle, BT_HDR *p_pkt, UINT32 time_stamp, UINT8 m_
}
/* map handle to scb */
if ((p_scb = avdt_scb_by_hdl(handle)) == NULL) {
osi_free(p_pkt);
result = AVDT_BAD_HANDLE;
} else {
evt.apiwrite.p_buf = p_pkt;
components/bt/host/bluedroid/stack/avdt/avdt_ccb.c
+6
View File
@@ -383,6 +383,12 @@ tAVDT_CCB *avdt_ccb_alloc(BD_ADDR bd_addr)
memcpy(p_ccb->peer_addr, bd_addr, BD_ADDR_LEN);
p_ccb->cmd_q = fixed_queue_new(QUEUE_SIZE_MAX);
p_ccb->rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
if (p_ccb->cmd_q == NULL || p_ccb->rsp_q == NULL) {
AVDT_TRACE_ERROR("avdt_ccb_alloc: queue alloc failed");
avdt_ccb_dealloc(p_ccb, NULL);
p_ccb = NULL;
break;
}
p_ccb->timer_entry.param = (UINT32) p_ccb;
AVDT_TRACE_DEBUG("avdt_ccb_alloc %d\n", i);
break;
components/bt/host/bluedroid/stack/avdt/avdt_ccb_act.c
+2
View File
@@ -712,6 +712,8 @@ void avdt_ccb_cmd_fail(tAVDT_CCB *p_ccb, tAVDT_CCB_EVT *p_data)
UINT8 evt;
tAVDT_SCB *p_scb;
memset(&msg, 0, sizeof(msg));
if (p_ccb->p_curr_cmd != NULL) {
if (p_ccb->p_curr_cmd->event < 1 || p_ccb->p_curr_cmd->event > AVDT_SIG_MAX) {
osi_free(p_ccb->p_curr_cmd);