Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid

Browse Source
This commit is contained in:
Jin Cheng
2026-03-30 16:57:32 +08:00
committed by Jin Cheng
parent 23b3bef319
commit d429d5d116
27 changed files with 438 additions and 245 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
components/bt/host/bluedroid/api/esp_bt_device.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -16,9 +16,7 @@
esp_err_t esp_bt_dev_register_callback(esp_bt_dev_cb_t callback)
{
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (callback == NULL) {
return ESP_ERR_INVALID_ARG;
@@ -31,7 +29,7 @@ esp_err_t esp_bt_dev_register_callback(esp_bt_dev_cb_t callback)
const uint8_t *esp_bt_dev_get_address(void)
{
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return NULL;
return NULL;
}
return controller_get_interface()->get_address()->address;
}
@@ -97,6 +95,8 @@ esp_err_t esp_bt_dev_coex_status_config(esp_bt_dev_coex_type_t type, esp_bt_dev_
esp_err_t esp_bt_config_file_path_get(char *file_path)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
return btc_config_file_path_get(file_path);
}

46
components/bt/host/bluedroid/api/esp_bt_main.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -31,19 +31,19 @@ esp_err_t esp_bluedroid_enable(void)
future_t **future_p;
if (s_bt_host_state == ESP_BLUEDROID_STATUS_UNINITIALIZED) {
LOG_ERROR("Bludroid not initialised\n");
LOG_ERROR("Bluedroid not initialised");
return ESP_ERR_INVALID_STATE;
}
if (s_bt_host_state == ESP_BLUEDROID_STATUS_ENABLED) {
LOG_ERROR("Bluedroid already enabled\n");
LOG_ERROR("Bluedroid already enabled");
return ESP_ERR_INVALID_STATE;
}
future_p = btc_main_get_future_p(BTC_MAIN_ENABLE_FUTURE);
*future_p = future_new();
if (*future_p == NULL) {
LOG_ERROR("Bluedroid enable failed\n");
LOG_ERROR("Bluedroid enable failed");
return ESP_ERR_NO_MEM;
}
@@ -53,12 +53,13 @@ esp_err_t esp_bluedroid_enable(void)
if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) {
future_free(*future_p);
LOG_ERROR("Bluedroid enable failed\n");
*future_p = NULL;
LOG_ERROR("Bluedroid enable failed");
return ESP_FAIL;
}
if (future_await(*future_p) == FUTURE_FAIL) {
LOG_ERROR("Bluedroid enable failed\n");
LOG_ERROR("Bluedroid enable failed");
return ESP_FAIL;
}
@@ -72,7 +73,7 @@ esp_err_t esp_bluedroid_disable(void)
future_t **future_p;
if (s_bt_host_state != ESP_BLUEDROID_STATUS_ENABLED) {
LOG_ERROR("Bluedroid already disabled\n");
LOG_ERROR("Bluedroid already disabled");
return ESP_ERR_INVALID_STATE;
}
@@ -81,7 +82,7 @@ esp_err_t esp_bluedroid_disable(void)
future_p = btc_main_get_future_p(BTC_MAIN_DISABLE_FUTURE);
*future_p = future_new();
if (*future_p == NULL) {
LOG_ERROR("Bluedroid disable failed\n");
LOG_ERROR("Bluedroid disable failed");
s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED;
return ESP_ERR_NO_MEM;
}
@@ -91,14 +92,15 @@ esp_err_t esp_bluedroid_disable(void)
msg.act = BTC_MAIN_ACT_DISABLE;
if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) {
LOG_ERROR("Bluedroid disable failed\n");
LOG_ERROR("Bluedroid disable failed");
future_free(*future_p);
*future_p = NULL;
s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED;
return ESP_FAIL;
}
if (future_await(*future_p) == FUTURE_FAIL) {
LOG_ERROR("Bluedroid disable failed\n");
LOG_ERROR("Bluedroid disable failed");
s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED;
return ESP_FAIL;
}
@@ -126,28 +128,28 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
if (cfg->sc_en) {
#if (SC_MODE_INCLUDED == FALSE)
LOG_ERROR("Secure Connections should not be enabled when target controller is ESP32.\n");
LOG_ERROR("It may trigger unresolved bugs in the controller.\n");
LOG_ERROR("Secure Connections should not be enabled when target controller is ESP32.");
LOG_ERROR("It may trigger unresolved bugs in the controller.");
return ESP_ERR_INVALID_ARG;
#endif // SC_MODE_INCLUDED
if (!cfg->ssp_en) {
LOG_ERROR("secure simple pairing should be enabled when secure connection host support is enabled\n");
LOG_ERROR("secure simple pairing should be enabled when secure connection host support is enabled");
return ESP_ERR_INVALID_ARG;
}
LOG_WARN("Please make sure to clear the bond list before enabling the secure connection host support\n");
LOG_WARN("Please make sure to clear the bond list before enabling the secure connection host support");
}
#if (BT_CONTROLLER_INCLUDED == TRUE)
if (esp_bt_controller_get_status() != ESP_BT_CONTROLLER_STATUS_ENABLED) {
LOG_ERROR("Controller not initialised\n");
LOG_ERROR("Controller not initialised");
return ESP_ERR_INVALID_STATE;
}
#endif
if (s_bt_host_state != ESP_BLUEDROID_STATUS_UNINITIALIZED) {
LOG_ERROR("Bluedroid already initialised\n");
LOG_ERROR("Bluedroid already initialised");
return ESP_ERR_INVALID_STATE;
}
@@ -205,6 +207,7 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) {
LOG_ERROR("Bluedroid Initialize Fail");
future_free(*future_p);
*future_p = NULL;
btc_deinit();
bluedroid_config_deinit();
#if HEAP_MEMORY_STATS
@@ -238,20 +241,20 @@ esp_err_t esp_bluedroid_deinit(void)
future_t **future_p;
if (s_bt_host_state == ESP_BLUEDROID_STATUS_UNINITIALIZED) {
LOG_ERROR("Bluedroid already de-initialised\n");
LOG_ERROR("Bluedroid already de-initialised");
return ESP_ERR_INVALID_STATE;
}
if (s_bt_host_state == ESP_BLUEDROID_STATUS_ENABLED ||
s_bt_host_state == ESP_BLUEDROID_STATUS_DISABLING) {
LOG_ERROR("Bludroid still enabled or stopping, disable first\n");
LOG_ERROR("Bluedroid still enabled or stopping, disable first");
return ESP_ERR_INVALID_STATE;
}
future_p = btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE);
*future_p = future_new();
if (*future_p == NULL) {
LOG_ERROR("Bluedroid de-initialise failed\n");
LOG_ERROR("Bluedroid de-initialise failed");
return ESP_ERR_NO_MEM;
}
@@ -260,13 +263,14 @@ esp_err_t esp_bluedroid_deinit(void)
msg.act = BTC_MAIN_ACT_DEINIT;
if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) {
LOG_ERROR("Bluedroid de-initialise failed\n");
LOG_ERROR("Bluedroid de-initialise failed");
future_free(*future_p);
*future_p = NULL;
return ESP_FAIL;
}
if (future_await(*future_p) == FUTURE_FAIL) {
LOG_ERROR("Bluedroid de-initialise failed\n");
LOG_ERROR("Bluedroid de-initialise failed");
return ESP_FAIL;
}

126
components/bt/host/bluedroid/api/esp_gap_bt_api.c
View File

@@ -22,9 +22,7 @@
esp_err_t esp_bt_gap_register_callback(esp_bt_gap_cb_t callback)
{
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (callback == NULL) {
return ESP_FAIL;
@@ -39,9 +37,7 @@ esp_err_t esp_bt_gap_set_scan_mode(esp_bt_connection_mode_t c_mode, esp_bt_disco
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
@@ -57,9 +53,7 @@ esp_err_t esp_bt_gap_start_discovery(esp_bt_inq_mode_t mode, uint8_t inq_len, ui
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (mode != ESP_BT_INQ_MODE_GENERAL_INQUIRY &&
mode != ESP_BT_INQ_MODE_LIMITED_INQUIRY) {
@@ -86,9 +80,7 @@ esp_err_t esp_bt_gap_cancel_discovery(void)
{
btc_msg_t msg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
@@ -102,9 +94,7 @@ esp_err_t esp_bt_gap_get_remote_services(esp_bd_addr_t remote_bda)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
@@ -119,8 +109,10 @@ esp_err_t esp_bt_gap_get_remote_service_record(esp_bd_addr_t remote_bda, esp_bt_
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (uuid == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
@@ -166,9 +158,7 @@ esp_err_t esp_bt_gap_config_eir_data(esp_bt_eir_data_t *eir_data)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (eir_data == NULL) {
return ESP_ERR_INVALID_ARG;
@@ -199,9 +189,7 @@ esp_err_t esp_bt_gap_set_cod(esp_bt_cod_t cod, esp_bt_cod_mode_t mode)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
switch (mode) {
case ESP_BT_SET_COD_RESERVED_2:
@@ -236,6 +224,9 @@ esp_err_t esp_bt_gap_read_rssi_delta(esp_bd_addr_t remote_addr)
{
btc_msg_t msg;
btc_gap_bt_args_t arg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
msg.act = BTC_GAP_BT_ACT_READ_RSSI_DELTA;
@@ -250,6 +241,8 @@ esp_err_t esp_bt_gap_read_acl_real_rssi(esp_bd_addr_t remote_addr)
btc_msg_t msg;
btc_gap_bt_args_t arg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
msg.act = BTC_GAP_BT_ACT_READ_ACL_REAL_RSSI;
@@ -262,6 +255,8 @@ esp_err_t esp_bt_gap_read_new_conn_tx_pwr_rng(void)
{
btc_msg_t msg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
msg.act = BTC_GAP_BT_ACT_READ_NEW_CONN_TX_PWR_LVL;
@@ -274,6 +269,8 @@ esp_err_t esp_bt_gap_write_new_conn_tx_pwr_rng(int8_t pwr_lvl_min, int8_t pwr_lv
btc_msg_t msg;
btc_gap_bt_args_t arg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (pwr_lvl_min < ESP_TX_PWR_LVL_MIN || pwr_lvl_min > ESP_TX_PWR_LVL_MAX ||
pwr_lvl_max < ESP_TX_PWR_LVL_MIN || pwr_lvl_max > ESP_TX_PWR_LVL_MAX ||
pwr_lvl_min > pwr_lvl_max) {
@@ -295,6 +292,8 @@ esp_err_t esp_bt_gap_read_tx_pwr_lvl(esp_bt_gap_tx_pwr_lvl_type_t type)
btc_msg_t msg;
btc_gap_bt_args_t arg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
#if (ESP_BT_CLASSIC_ENABLE_POWER_CTRL_VSC == TRUE)
if (type >= ESP_BT_GAP_TX_PWR_LVL_TYPE_MAX) {
return ESP_ERR_INVALID_ARG;
@@ -318,6 +317,8 @@ esp_err_t esp_bt_gap_write_tx_pwr_lvl(esp_bt_gap_tx_pwr_lvl_type_t type, int8_t
btc_msg_t msg;
btc_gap_bt_args_t arg;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
#if (ESP_BT_CLASSIC_ENABLE_POWER_CTRL_VSC == TRUE)
if (type >= ESP_BT_GAP_TX_PWR_LVL_TYPE_MAX ||
tx_power < ESP_TX_PWR_LVL_MIN || tx_power > ESP_TX_PWR_LVL_MAX) {
@@ -346,9 +347,7 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
@@ -360,9 +359,8 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr)
int esp_bt_gap_get_bond_device_num(void)
{
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
return btc_storage_get_num_bt_bond_devices();
}
@@ -370,14 +368,12 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
{
int ret;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (dev_num == NULL || dev_list == NULL) {
return ESP_ERR_INVALID_ARG;
}
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, dev_num);
return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -388,8 +384,12 @@ esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, e
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (pin_type == ESP_BT_PIN_TYPE_FIXED) {
if ((pin_code == NULL) || (pin_code_len == 0) || (pin_code_len > ESP_BT_PIN_CODE_LEN)) {
return ESP_ERR_INVALID_ARG;
}
}
msg.sig = BTC_SIG_API_CALL;
@@ -413,17 +413,22 @@ esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_c
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (accept && ((pin_code == NULL) || (pin_code_len == 0) || (pin_code_len > ESP_BT_PIN_CODE_LEN))) {
return ESP_ERR_INVALID_ARG;
}
memset(&arg, 0, sizeof(btc_gap_bt_args_t));
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
msg.act = BTC_GAP_BT_ACT_PIN_REPLY;
arg.pin_reply.accept = accept;
arg.pin_reply.pin_code_len = pin_code_len;
memcpy(arg.pin_reply.bda.address, bd_addr, sizeof(esp_bd_addr_t));
memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len);
if (accept) {
arg.pin_reply.pin_code_len = pin_code_len;
memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len);
}
return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), btc_gap_bt_arg_deep_copy,
btc_gap_bt_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -435,8 +440,11 @@ esp_err_t esp_bt_gap_set_security_param(esp_bt_sp_param_t param_type,
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((param_type > ESP_BT_SP_IOCAP_MODE) || (value == NULL) ||
((param_type == ESP_BT_SP_IOCAP_MODE) && (len < 1))) {
return ESP_ERR_INVALID_ARG;
}
if (!(bluedroid_config_get()->get_ssp_enabled())) {
@@ -460,9 +468,7 @@ esp_err_t esp_bt_gap_ssp_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint3
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (!(bluedroid_config_get()->get_ssp_enabled())) {
ESP_LOGE(TAG, "%s is not supported when `ssp_en` in `esp_bluedroid_config_t` is disabled!", __func__);
@@ -484,9 +490,7 @@ esp_err_t esp_bt_gap_ssp_confirm_reply(esp_bd_addr_t bd_addr, bool accept)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (!(bluedroid_config_get()->get_ssp_enabled())) {
ESP_LOGE(TAG, "%s is not supported when `ssp_en` in `esp_bluedroid_config_t` is disabled!", __func__);
@@ -507,9 +511,7 @@ esp_err_t esp_bt_gap_set_afh_channels(esp_bt_gap_afh_channels channels)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
@@ -525,9 +527,7 @@ esp_err_t esp_bt_gap_read_remote_name(esp_bd_addr_t remote_bda)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BT;
@@ -542,9 +542,7 @@ esp_err_t esp_bt_gap_set_qos(esp_bd_addr_t remote_bda, uint32_t t_poll)
btc_msg_t msg;
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (t_poll < ESP_BT_GAP_TPOLL_MIN || t_poll > ESP_BT_GAP_TPOLL_MAX) {
return ESP_ERR_INVALID_ARG;
@@ -565,7 +563,7 @@ esp_err_t esp_bt_gap_set_page_timeout(uint16_t page_to)
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
return ESP_ERR_INVALID_STATE;
}
if (page_to < HCI_MIN_PAGE_TOUT) {
return ESP_ERR_INVALID_ARG;
@@ -584,7 +582,7 @@ esp_err_t esp_bt_gap_get_page_timeout(void)
btc_msg_t msg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
return ESP_ERR_INVALID_STATE;
}
msg.sig = BTC_SIG_API_CALL;
@@ -600,7 +598,7 @@ esp_err_t esp_bt_gap_set_acl_pkt_types(esp_bd_addr_t remote_bda, uint16_t pkt_ty
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
return ESP_ERR_INVALID_STATE;
}
msg.sig = BTC_SIG_API_CALL;
@@ -619,7 +617,7 @@ esp_err_t esp_bt_gap_set_min_enc_key_size(uint8_t key_size)
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
return ESP_ERR_INVALID_STATE;
}
if (key_size < ESP_BT_ENC_KEY_SIZE_CTRL_MIN || key_size > ESP_BT_ENC_KEY_SIZE_CTRL_MAX) {
@@ -641,7 +639,7 @@ esp_err_t esp_bt_gap_set_device_name(const char *name)
btc_gap_bt_args_t arg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
return ESP_ERR_INVALID_STATE;
}
if ((!name) || (strlen(name) > BTC_MAX_LOC_BD_NAME_LEN)) {
return ESP_ERR_INVALID_ARG;
@@ -661,7 +659,7 @@ esp_err_t esp_bt_gap_get_device_name(void)
btc_msg_t msg;
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
return ESP_ERR_INVALID_STATE;
}
msg.sig = BTC_SIG_API_CALL;
@@ -677,9 +675,7 @@ esp_err_t esp_bt_gap_get_profile_status(esp_bt_gap_profile_status_t *profile_sta
return ESP_ERR_INVALID_ARG;
}
if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
return ESP_ERR_INVALID_STATE;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
memset(profile_status, 0, sizeof(esp_bt_gap_profile_status_t));
btc_gap_bt_status_get(profile_status);

10
components/bt/host/bluedroid/api/esp_sdp_api.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -36,13 +36,13 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
case ESP_SDP_TYPE_MAP_MAS:
if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) {
LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n");
ret = false;
ret = false;
}
break;
case ESP_SDP_TYPE_PBAP_PSE:
if (record->pse.supported_repositories >> 8) {
LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n");
ret = false;
ret = false;
}
break;
@@ -50,7 +50,8 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
break;
}
if (record->hdr.type != ESP_SDP_TYPE_DIP_SERVER) {
if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
if (record->hdr.service_name == NULL ||
record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
LOG_ERROR("Invalid server name!\n");
ret = false;
@@ -167,6 +168,7 @@ esp_err_t esp_sdp_remove_record(int record_handle)
msg.pid = BTC_PID_SDP;
msg.act = BTC_SDP_ACT_REMOVE_RECORD;
memset(&arg, 0, sizeof(btc_sdp_args_t));
arg.remove_record.record_handle = record_handle;
/* Switch to BTC context */

12
components/bt/host/bluedroid/bta/dm/bta_dm_pm.c
View File

@@ -433,10 +433,10 @@ static void bta_dm_pm_cback(tBTA_SYS_CONN_STATUS status, UINT8 id, UINT8 app_id,
((NULL != (p = BTM_ReadRemoteFeatures (peer_addr))) && HCI_SNIFF_SUB_RATE_SUPPORTED(p)) &&
(index == BTA_DM_PM_SSR0)) {
if (status == BTA_SYS_SCO_OPEN) {
APPL_TRACE_DEBUG("%s: SCO inactive, reset SSR to zero", __func__);
APPL_TRACE_DEBUG("%s: SCO active, reset SSR to zero", __func__);
BTM_SetSsrParams (peer_addr, 0, 0, 0 );
} else if (status == BTA_SYS_SCO_CLOSE) {
APPL_TRACE_DEBUG("%s: SCO active, back to old SSR", __func__);
APPL_TRACE_DEBUG("%s: SCO inactive, back to old SSR", __func__);
bta_dm_pm_ssr(peer_addr);
}
}
@@ -621,8 +621,8 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request,
}
return;
}
/* if pending power mode timer expires, and currecnt link is in a
lower power mode than current profile requirement, igonre it */
/* if pending power mode timer expires, and current link is in a
lower power mode than current profile requirement, ignore it */
if (pm_req == BTA_DM_PM_EXECUTE && pm_request < pm_action) {
APPL_TRACE_ERROR("Ignore the power mode request: %d", pm_request)
return;
@@ -644,7 +644,7 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request,
}
/*******************************************************************************
**
** Function bta_ag_pm_park
** Function bta_dm_pm_park
**
** Description Switch to park mode.
**
@@ -669,7 +669,7 @@ static BOOLEAN bta_dm_pm_park(BD_ADDR peer_addr)
/*******************************************************************************
**
** Function bta_ag_pm_sniff
** Function bta_dm_pm_sniff
**
** Description Switch to sniff mode.
**

4
components/bt/host/bluedroid/bta/dm/bta_dm_qos.c
View File

@@ -33,7 +33,7 @@
void bta_dm_set_qos(tBTA_DM_MSG *p_data)
{
FLOW_SPEC p_flow = {
FLOW_SPEC flow = {
.qos_flags = 0, /* TBD */
.service_type = NO_TRAFFIC, /* service_type */
.token_rate = 0, /* bytes/second */
@@ -43,7 +43,7 @@ void bta_dm_set_qos(tBTA_DM_MSG *p_data)
.delay_variation = 0xFFFFFFFF /* microseconds */
};
tBTM_STATUS status = BTM_SetQoS (p_data->qos_set.bd_addr, &p_flow, p_data->qos_set.p_cb);
tBTM_STATUS status = BTM_SetQoS (p_data->qos_set.bd_addr, &flow, p_data->qos_set.p_cb);
if(status != BTM_CMD_STARTED) {
APPL_TRACE_ERROR("%s ERROR: 0x%x\n", __func__, status);

12
components/bt/host/bluedroid/bta/dm/bta_dm_sco.c
View File

@@ -20,7 +20,7 @@
*
* This file contains the down sampling utility to convert PCM samples in
* 16k/32k/48k/44.1k/22050/11025 sampling rate into 8K/16bits samples
* required for SCO channel format. One API function isprovided and only
* required for SCO channel format. One API function is provided and only
* possible to be used when transmitting SCO data is sent via HCI
* interface.
*
@@ -76,10 +76,12 @@ static tBTA_DM_PCM_RESAMPLE_CB* p_bta_dm_pcm_cb;
#define CHECK_SATURATION16(x) \
do { \
if (x > 32767) \
x = 32767; \
else if (x < -32768) \
x = -32768;
x = -32768; \
} while (0);
////////////////////////////////////////////////////////////////////////////////////////////////////
//
@@ -630,8 +632,10 @@ void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels)
**
*******************************************************************************/
void BTA_DmPcmDeinitSamples(void) {
osi_free(p_bta_dm_pcm_cb);
p_bta_dm_pcm_cb = NULL;
if (p_bta_dm_pcm_cb) {
osi_free(p_bta_dm_pcm_cb);
p_bta_dm_pcm_cb = NULL;
}
}
/**************************************************************************************

2
components/bt/host/bluedroid/bta/sdp/bta_sdp.c
View File

@@ -18,7 +18,7 @@
/******************************************************************************
*
* This is the main implementation file for the BTA MCE I/F
* This is the main implementation file for the BTA SDP I/F
*
******************************************************************************/

2
components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c
View File

@@ -628,7 +628,7 @@ void bta_sdp_remove_record(tBTA_SDP_MSG *p_data)
**
** Function bta_sdp_disable
**
** Description Removes an SDP record
** Description Disable SDP
**
** Returns void
**

4
components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c
View File

@@ -157,6 +157,10 @@ tBTA_SDP_STATUS BTA_SdpSearch(BD_ADDR bd_addr, tSDP_UUID *uuid)
tBTA_SDP_STATUS ret = BTA_SDP_FAILURE;
tBTA_SDP_API_SEARCH *p_msg;
if (!uuid) {
return BTA_SDP_FAILURE;
}
APPL_TRACE_API("%s\n", __FUNCTION__);
if ((p_msg = (tBTA_SDP_API_SEARCH *)osi_malloc(sizeof(tBTA_SDP_API_SEARCH))) != NULL) {
p_msg->hdr.event = BTA_SDP_API_SEARCH_EVT;

2
components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c
View File

@@ -52,6 +52,6 @@ tBTA_SDP_CFG bta_sdp_cfg = {
#endif
};
tBTA_SDP_CFG *p_bta_sdp_cfg = (tBTA_SDP_CFG *) &bta_sdp_cfg;
tBTA_SDP_CFG *p_bta_sdp_cfg = &bta_sdp_cfg;
#endif /* #if defined(BTA_SDP_INCLUDED) && (BTA_SDP_INCLUDED == TRUE) */

14
components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -11,9 +11,15 @@
#if (BTC_GAP_BT_INCLUDED == TRUE)
void btc_gap_bt_config_eir_cmpl_callback (uint8_t status, uint8_t eir_type_num, uint8_t *eir_type)
{
esp_bt_gap_cb_param_t param;
esp_bt_gap_cb_param_t param = {0};
btc_msg_t msg = {0};
bt_status_t ret;
btc_msg_t msg;
if (!eir_type || (eir_type_num > ESP_BT_EIR_TYPE_MAX_NUM)) {
BTC_TRACE_ERROR("%s invalid params", __func__);
return;
}
msg.sig = BTC_SIG_API_CB;
msg.pid = BTC_PID_GAP_BT;
msg.act = BTC_GAP_BT_CONFIG_EIR_DATA_EVT;
@@ -26,7 +32,7 @@ void btc_gap_bt_config_eir_cmpl_callback (uint8_t status, uint8_t eir_type_num,
sizeof(esp_bt_gap_cb_param_t), NULL, NULL);
if (ret != BT_STATUS_SUCCESS) {
BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__);
}
}
#endif /// (BTC_GAP_BT_INCLUDED == TRUE)

10
components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c
View File

@@ -89,7 +89,6 @@ static void btc_bt_set_scan_mode(esp_bt_connection_mode_t c_mode, esp_bt_discove
}
BTA_DmSetVisibility(disc_mode, conn_mode, BTA_DM_IGNORE, BTA_DM_IGNORE);
return;
}
static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg)
@@ -97,7 +96,7 @@ static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg)
tBTA_DM_INQ inq_params;
tBTA_SERVICE_MASK services = 0;
BTIF_TRACE_EVENT("%s", __FUNCTION__);
BTIF_TRACE_EVENT("%s", __func__);
inq_params.mode = (arg->start_disc.mode == ESP_BT_INQ_MODE_GENERAL_INQUIRY) ?
BTA_DM_GENERAL_INQUIRY : BTA_DM_LIMITED_INQUIRY;
@@ -112,8 +111,6 @@ static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg)
gap_bt_local_param.disc_stat = ESP_BT_GAP_DISCOVERY_STOPPED;
/* find nearby devices */
BTA_DmSearch(&inq_params, services, bte_search_devices_evt);
return;
}
static void btc_gap_bt_cancel_discovery(void)
@@ -1342,7 +1339,6 @@ void btc_gap_bt_call_handler(btc_msg_t *msg)
break;
}
btc_gap_bt_arg_deep_free(msg);
return;
}
void btc_gap_bt_busy_level_updated(uint8_t bl_flags)
@@ -1407,7 +1403,7 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg)
break;
}
default:
BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __func__, msg->act);
break;
}
}
@@ -1527,7 +1523,7 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg)
break;
}
default:
BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __func__, msg->act);
break;
}
btc_gap_bt_cb_deep_free(msg);

38
components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -353,21 +353,25 @@ static int free_sdp_slot(int id)
sdp_slot_t *slot = NULL;
if(id >= SDP_MAX_RECORDS) {
APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
return handle;
}
slot = sdp_local_param.sdp_slots[id];
if (slot == NULL) {
// already freed
BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
return handle;
}
osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
slot = sdp_local_param.sdp_slots[id];
if (slot == NULL) {
osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
return handle;
}
handle = slot->sdp_handle;
if (slot->state != SDP_RECORD_FREE) {
/* safe a copy of the pointer, and free after unlock() */
record = slot->record_data;
}
osi_free(sdp_local_param.sdp_slots[id]);
sdp_local_param.sdp_slots[id] = NULL;
osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
if(record != NULL) {
@@ -376,8 +380,6 @@ static int free_sdp_slot(int id)
// Record have already been freed
handle = -1;
}
osi_free(sdp_local_param.sdp_slots[id]);
sdp_local_param.sdp_slots[id] = NULL;
return handle;
}
@@ -623,7 +625,7 @@ static int add_mapc_sdp(const bluetooth_sdp_mns_record* rec)
sdp_handle = 0;
BTC_TRACE_ERROR("%s() FAILED", __func__);
} else {
bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */
bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_NOTIFICATION */
BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle);
}
@@ -703,7 +705,7 @@ static int add_pbaps_sdp(const bluetooth_sdp_pse_record* rec)
sdp_handle = 0;
BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status);
} else {
bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */
bta_sys_add_uuid(service); /* UUID_SERVCLASS_PBAP_PSE */
BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle);
}
@@ -749,7 +751,7 @@ static int add_pbapc_sdp(const bluetooth_sdp_pce_record* rec)
sdp_handle = 0;
BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status);
} else {
bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */
bta_sys_add_uuid(service); /* UUID_SERVCLASS_PBAP_PCE */
BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle);
}
@@ -1040,6 +1042,10 @@ static void btc_sdp_cb_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
tBTA_SDP_SEARCH_COMP *dest_search_comp = (tBTA_SDP_SEARCH_COMP *)p_dest;
int record_count = src_search_comp->record_count;
if (record_count > BTA_SDP_MAX_RECORDS) {
record_count = BTA_SDP_MAX_RECORDS;
}
for (int i = 0; i < record_count; i++) {
bluetooth_sdp_record *src_record = &src_search_comp->records[i];
bluetooth_sdp_record *dest_record = &dest_search_comp->records[i];
@@ -1091,7 +1097,12 @@ static void btc_sdp_cb_arg_deep_free(btc_msg_t *msg)
switch (msg->act) {
case BTA_SDP_SEARCH_COMP_EVT: {
tBTA_SDP_SEARCH_COMP *search_comp = (tBTA_SDP_SEARCH_COMP *)msg->arg;
for (size_t i = 0; i < search_comp->record_count; i++) {
int record_count = search_comp->record_count;
if (record_count > BTA_SDP_MAX_RECORDS) {
record_count = BTA_SDP_MAX_RECORDS;
}
for (size_t i = 0; i < record_count; i++) {
bluetooth_sdp_record *record = &search_comp->records[i];
if (record->hdr.service_name) {
osi_free(record->hdr.service_name);
@@ -1416,7 +1427,6 @@ void btc_sdp_cb_handler(btc_msg_t *msg)
int slot_id = get_sdp_slot_id_by_handle(p_data->sdp_remove_record.handle);
if (slot_id < 0) {
p_data->sdp_remove_record.status = ESP_SDP_NO_CREATE_RECORD;
break;
} else {
free_sdp_slot(slot_id);
}

64
components/bt/host/bluedroid/stack/btm/btm_sco.c
View File

@@ -24,7 +24,6 @@
******************************************************************************/
#include <string.h>
#include "stack/bt_types.h"
#include "common/bt_target.h"
#include "stack/bt_types.h"
#include "stack/hcimsgs.h"
@@ -405,10 +404,13 @@ static void btm_pkt_stat_nums_update(uint16_t sco_inx, uint8_t pkt_status)
*******************************************************************************/
static void btm_pkt_stat_send_nums_update(uint16_t sco_inx, uint8_t pkt_status)
{
tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
p_ccb->pkt_stat_nums.tx_total++;
if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) {
p_ccb->pkt_stat_nums.tx_discarded++;
tSCO_CONN *p_ccb = NULL;
if (sco_inx < BTM_MAX_SCO_LINKS) {
p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
p_ccb->pkt_stat_nums.tx_total++;
if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) {
p_ccb->pkt_stat_nums.tx_discarded++;
}
}
}
@@ -461,6 +463,7 @@ void btm_route_sco_data(BT_HDR *p_msg)
#if BTM_SCO_HCI_INCLUDED == TRUE
UINT16 sco_inx, handle;
UINT8 *p = (UINT8 *)(p_msg + 1) + p_msg->offset;
UINT16 len = p_msg->len;
UINT8 pkt_size = 0;
UINT8 pkt_status = 0;
@@ -470,12 +473,12 @@ void btm_route_sco_data(BT_HDR *p_msg)
handle = HCID_GET_HANDLE (handle);
STREAM_TO_UINT8 (pkt_size, p);
UNUSED(len);
UNUSED(pkt_size);
if ((sco_inx = btm_find_scb_by_handle(handle)) != BTM_MAX_SCO_LINKS ) {
/* send data callback */
if (!btm_cb.sco_cb.p_data_cb )
if (!btm_cb.sco_cb.p_data_cb) {
/* if no data callback registered, just free the buffer */
{
osi_free (p_msg);
} else {
btm_pkt_stat_nums_update(sco_inx, pkt_status);
@@ -484,7 +487,7 @@ void btm_route_sco_data(BT_HDR *p_msg)
} else { /* no mapping handle SCO connection is active, free the buffer */
osi_free (p_msg);
}
BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, p_msg->len, pkt_size);
BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, len, pkt_size);
#else
osi_free(p_msg);
#endif
@@ -516,12 +519,13 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
{
APPL_TRACE_DEBUG("%s", __FUNCTION__);
#if (BTM_SCO_HCI_INCLUDED == TRUE) && (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p_ccb = NULL;
UINT8 *p;
tBTM_STATUS status = BTM_SUCCESS;
if (sco_inx < BTM_MAX_SCO_LINKS && btm_cb.sco_cb.p_data_cb &&
p_ccb->state == SCO_ST_CONNECTED) {
btm_cb.sco_cb.sco_db[sco_inx].state == SCO_ST_CONNECTED) {
p_ccb = &btm_cb.sco_cb.sco_db[sco_inx];
/* Ensure we have enough space in the buffer for the SCO and HCI headers */
if (p_buf->offset < HCI_SCO_PREAMBLE_SIZE) {
BTM_TRACE_ERROR ("BTM SCO - cannot send buffer, offset: %d", p_buf->offset);
@@ -557,8 +561,12 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
}
}
} else {
BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]",
sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state);
if (sco_inx < BTM_MAX_SCO_LINKS) {
BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]",
sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state);
} else {
BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d", sco_inx);
}
status = BTM_UNKNOWN_ADDR;
}
@@ -566,7 +574,9 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
BTM_TRACE_WARNING ("stat %d", status);
osi_free(p_buf);
}
btm_pkt_stat_send_nums_update(sco_inx, status);
if (sco_inx < BTM_MAX_SCO_LINKS) {
btm_pkt_stat_send_nums_update(sco_inx, status);
}
return (status);
#else
@@ -722,8 +732,13 @@ void btm_accept_sco_link(UINT16 sco_inx, tBTM_ESCO_PARAMS *p_setup,
** Returns void
**
*******************************************************************************/
void btm_reject_sco_link( UINT16 sco_inx )
void btm_reject_sco_link( UINT16 sco_inx)
{
if (sco_inx >= BTM_MAX_SCO_LINKS) {
BTM_TRACE_ERROR("btm_reject_sco_link: Invalid sco_inx(%d)", sco_inx);
return;
}
btm_esco_conn_rsp(sco_inx, HCI_ERR_HOST_REJECT_RESOURCES,
btm_cb.sco_cb.sco_db[sco_inx].esco.data.bd_addr, NULL);
}
@@ -1373,10 +1388,12 @@ tBTM_STATUS BTM_SetScoPacketTypes (UINT16 sco_inx, UINT16 pkt_types)
UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx)
{
#if (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p = NULL;
/* Validity check */
if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) {
if ((sco_inx < BTM_MAX_SCO_LINKS) &&
((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) &&
(p->state == SCO_ST_CONNECTED)) {
return (p->esco.setup.packet_types);
} else {
return (0);
@@ -1425,10 +1442,12 @@ UINT16 BTM_ReadDeviceScoPacketTypes (void)
UINT16 BTM_ReadScoHandle (UINT16 sco_inx)
{
#if (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p = NULL;;
/* Validity check */
if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) {
if ((sco_inx < BTM_MAX_SCO_LINKS) &&
((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) &&
(p->state == SCO_ST_CONNECTED)) {
return (p->hci_handle);
} else {
return (BTM_INVALID_HCI_HANDLE);
@@ -1451,10 +1470,11 @@ UINT16 BTM_ReadScoHandle (UINT16 sco_inx)
UINT8 *BTM_ReadScoBdAddr (UINT16 sco_inx)
{
#if (BTM_MAX_SCO_LINKS>0)
tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx];
tSCO_CONN *p = NULL;
/* Validity check */
if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->rem_bd_known)) {
if ((sco_inx < BTM_MAX_SCO_LINKS) &&
((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && (p->rem_bd_known)) {
return (p->esco.data.bd_addr);
} else {
return (NULL);
@@ -1538,7 +1558,9 @@ tBTM_STATUS BTM_RegForEScoEvts (UINT16 sco_inx, tBTM_ESCO_CBACK *p_esco_cback)
{
#if (BTM_MAX_SCO_LINKS>0)
if (!btm_cb.sco_cb.esco_supported) {
btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL;
if (sco_inx < BTM_MAX_SCO_LINKS) {
btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL;
}
return (BTM_MODE_UNSUPPORTED);
}

24
components/bt/host/bluedroid/stack/gap/gap_conn.c
View File

@@ -304,15 +304,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1
if (!p_ccb) {
return (GAP_ERR_BAD_HANDLE);
}
if (!p_len) {
return (GAP_ERR_ILL_PARM);
}
*p_len = 0;
osi_mutex_global_lock();
if (fixed_queue_is_empty(p_ccb->rx_queue)) {
osi_mutex_global_unlock();
return (GAP_NO_DATA_AVAIL);
}
osi_mutex_global_lock();
while (max_len) {
BT_HDR *p_buf = fixed_queue_try_peek_first(p_ccb->rx_queue);
if (p_buf == NULL) {
@@ -359,19 +363,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1
int GAP_GetRxQueueCnt (UINT16 handle, UINT32 *p_rx_queue_count)
{
tGAP_CCB *p_ccb;
int rc = BT_PASS;
int rc = GAP_INVALID_HANDLE;
if (!p_rx_queue_count) {
return GAP_ERR_ILL_PARM;
}
/* Check that handle is valid */
if (handle < GAP_MAX_CONNECTIONS) {
p_ccb = &gap_cb.conn.ccb_pool[handle];
p_ccb = gap_find_ccb_by_handle (handle);
if (p_ccb) {
if (p_ccb->con_state == GAP_CCB_STATE_CONNECTED) {
*p_rx_queue_count = p_ccb->rx_queue_size;
} else {
rc = GAP_INVALID_HANDLE;
rc = BT_PASS;
}
} else {
rc = GAP_INVALID_HANDLE;
}
GAP_TRACE_EVENT ("GAP_GetRxQueueCnt - rc = 0x%04x, rx_queue_count=%d",

3
components/bt/host/bluedroid/stack/l2cap/l2c_csm.c
View File

@@ -33,7 +33,6 @@
#include "l2c_int.h"
#include "btm_int.h"
#include "stack/btu.h"
#include "stack/hcimsgs.h"
#include "osi/allocator.h"
#if (L2CAP_COC_INCLUDED == TRUE)
@@ -121,7 +120,6 @@ void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
*******************************************************************************/
static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data;
UINT16 local_cid = p_ccb->local_cid;
tL2CA_DISCONNECT_IND_CB *disconnect_ind;
tL2CA_CONNECT_CFM_CB *connect_cfm;
@@ -168,6 +166,7 @@ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
break;
case L2CEVT_LP_CONNECT_CFM_NEG: /* Link failed */
tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data;
/* Disconnect unless ACL collision and upper layer wants to handle it */
if (p_ci->status != HCI_ERR_CONNECTION_EXISTS
|| !btm_acl_notif_conn_collision(p_ccb->p_lcb->remote_bd_addr)) {

26
components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c
View File

@@ -892,7 +892,7 @@ static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
/* If anything still waiting for ack, restart the timer if it was stopped */
if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q)) {
l2c_fcr_start_timer(p_ccb);
}
}
return (TRUE);
}
@@ -1342,7 +1342,7 @@ static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_wo
p_buf->len -= 2;
if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) {
L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_ccb->max_rx_mtu);
packet_ok = FALSE;
} else if ((p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL) {
L2CAP_TRACE_ERROR ("SAR - no buffer for SDU start user_rx_buf_size:%d", p_ccb->ertm_info.user_rx_buf_size);
@@ -1451,7 +1451,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
if (tx_seq == buf_seq) {
break;
}
}
}
}
@@ -1466,24 +1466,24 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
// the transmit data queue that satisfy the layer and event conditions.
for (const list_node_t *node = list_begin(p_ccb->p_lcb->link_xmit_data_q);
node != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
BT_HDR *p_buf = (BT_HDR *)list_node(node);
BT_HDR *p_node_buf = (BT_HDR *)list_node(node);
node = list_next(node);
/* Do not flush other CIDs or partial segments */
if ((p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid)) {
list_remove(p_ccb->p_lcb->link_xmit_data_q, p_buf);
osi_free(p_buf);
if ((p_node_buf->layer_specific == 0) && (p_node_buf->event == p_ccb->local_cid)) {
list_remove(p_ccb->p_lcb->link_xmit_data_q, p_node_buf);
osi_free(p_node_buf);
}
}
/* Also flush our retransmission queue */
while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q)) {
osi_free(fixed_queue_dequeue(p_ccb->fcrb.retrans_q, 0));
}
}
if (list_ack != NULL) {
node_ack = list_begin(list_ack);
}
}
}
if (list_ack != NULL) {
@@ -1502,7 +1502,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) ) {
break;
}
}
}
}
@@ -2150,11 +2150,11 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index]) {
p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
}
}
if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index]) {
p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
}
}
/* update sum, max and min of round trip delay of acking */
list_t *list = NULL;
@@ -2186,7 +2186,7 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
if ( delay < p_ccb->fcrb.ack_delay_min[index] ) {
p_ccb->fcrb.ack_delay_min[index] = delay;
}
}
}
}
}

7
components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c
View File

@@ -90,6 +90,12 @@ static void l2c_ucd_data_ind_cback (BD_ADDR rem_bda, BT_HDR *p_buf)
L2CAP_TRACE_DEBUG ("L2CAP - l2c_ucd_data_ind_cback");
if (p_buf->len < L2CAP_UCD_OVERHEAD) {
L2CAP_TRACE_ERROR ("L2CAP - data not enough for l2c_ucd_data_ind_cback %d", p_buf->len);
osi_free (p_buf);
return;
}
p = (UINT8 *)(p_buf + 1) + p_buf->offset;
STREAM_TO_UINT16(psm, p)
@@ -257,7 +263,6 @@ BOOLEAN L2CA_UcdDeregister_In_CCB_List (void *p_ccb_node, void * context)
BOOLEAN L2CA_UcdDeregister ( UINT16 psm )
{
tL2C_CCB *p_ccb;
tL2C_RCB *p_rcb;
UINT16 xx;

7
components/bt/host/bluedroid/stack/l2cap/l2cap_client.c
View File

@@ -368,11 +368,18 @@ static void read_ready_cb(uint16_t local_channel_id, BT_HDR *packet)
l2cap_client_t *client = find(local_channel_id);
if (!client) {
L2CAP_TRACE_ERROR("%s unable to find L2CAP client matching LCID 0x%04x.\n", __func__, local_channel_id);
osi_free(packet);
return;
}
// TODO(sharvil): eliminate copy from BT_HDR.
buffer_t *buffer = buffer_new(packet->len);
if (!buffer) {
L2CAP_TRACE_ERROR("%s unable to new a buffer\n", __func__);
osi_free(packet);
return;
}
memcpy(buffer_ptr(buffer), packet->data + packet->offset, packet->len);
osi_free(packet);

12
components/bt/host/bluedroid/stack/sdp/sdp_api.c
View File

@@ -72,8 +72,8 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui
/* verify the parameters */
if (p_db == NULL || (sizeof (tSDP_DISCOVERY_DB) > len) ||
num_attr > SDP_MAX_ATTR_FILTERS || num_uuid > SDP_MAX_UUID_FILTERS) {
SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db 0x%x, len %d, num_uuid %d, num_attr %d",
(UINT32)p_db, len, num_uuid, num_attr);
SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db %p, len %d, num_uuid %d, num_attr %d",
p_db, len, num_uuid, num_attr);
return (FALSE);
}
@@ -99,8 +99,9 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui
sdpu_sort_attr_list( num_attr, p_db );
p_db->num_attr_filters = num_attr;
#endif
return (TRUE);
#endif
return (FALSE);
}
@@ -124,8 +125,9 @@ BOOLEAN SDP_CancelServiceSearch (tSDP_DISCOVERY_DB *p_db)
sdp_disconnect (p_ccb, SDP_CANCEL);
p_ccb->disc_state = SDP_DISC_WAIT_CANCEL;
#endif
return (TRUE);
#endif
return (FALSE);
}
@@ -429,7 +431,7 @@ BOOLEAN SDP_FindServiceUUIDInRec_128bit(tSDP_DISC_REC *p_rec, tBT_UUID *p_uuid)
for (p_sattr = p_attr->attr_value.v.p_sub_attr; p_sattr; p_sattr = p_sattr->p_next_attr) {
if (SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UUID_DESC_TYPE) {
/* only support 128 bits UUID for now */
if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 16) {
if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == LEN_UUID_128) {
p_uuid->len = LEN_UUID_128;
for (uint8_t i = 0; i != LEN_UUID_128; ++i) {
p_uuid->uu.uuid128[i] = p_sattr->attr_value.v.array[LEN_UUID_128 - i - 1];

27
components/bt/host/bluedroid/stack/sdp/sdp_db.c
View File

@@ -68,15 +68,15 @@ tSDP_RECORD *sdp_db_service_search (tSDP_RECORD *p_rec, tSDP_UUID_SEQ *p_seq)
/* If NULL, start at the beginning, else start at the first specified record */
if (!p_rec) {
p_node = list_begin(sdp_cb.server_db.p_record_list);
p_node = list_begin(sdp_cb.server_db.p_record_list);
} else {
/* get node in the record list with given p_rec */
/* get node in the record list with given p_rec */
p_node = list_get_node(sdp_cb.server_db.p_record_list, p_rec);
if (p_node == NULL) {
return NULL;
}
/* get next node */
p_node = list_next(p_node);
if (p_node == NULL) {
return NULL;
}
/* get next node */
p_node = list_next(p_node);
}
/* Look through the records. The spec says that a match occurs if */
@@ -178,8 +178,8 @@ tSDP_RECORD *sdp_db_find_record (UINT32 handle)
/* Look through the records for the caller's handle */
for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
p_rec = list_node(p_node);
if (p_rec->record_handle == handle) {
p_rec = list_node(p_node);
if (p_rec->record_handle == handle) {
return (p_rec);
}
}
@@ -446,7 +446,7 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type,
/* Find the record in the database */
for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
p_rec= list_node(p_node);
p_rec= list_node(p_node);
if (p_rec->record_handle == handle) {
tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0];
@@ -498,13 +498,12 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type,
}
}
if ((attr_len > 0) && (p_val != 0)) {
if (attr_len > 0) {
p_attr->len = attr_len;
memcpy (&p_rec->attr_pad[p_rec->free_pad_ptr], p_val, (size_t)attr_len);
p_attr->value_ptr = &p_rec->attr_pad[p_rec->free_pad_ptr];
p_rec->free_pad_ptr += attr_len;
} else if ((attr_len == 0 && p_attr->len != 0) || /* if truncate to 0 length, simply don't add */
p_val == 0) {
} else if (attr_len == 0 && p_attr->len != 0) { /* if truncate to 0 length, simply don't add */
SDP_TRACE_ERROR("SDP_AddAttribute fail, length exceed maximum: ID %d: attr_len:%d \n",
attr_id, attr_len );
p_attr->id = p_attr->type = p_attr->len = 0;
@@ -889,7 +888,7 @@ BOOLEAN SDP_DeleteAttribute (UINT32 handle, UINT16 attr_id)
/* Find the record in the database */
for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
p_rec= list_node(p_node);
p_rec= list_node(p_node);
if (p_rec->record_handle == handle) {
tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0];

10
components/bt/host/bluedroid/stack/sdp/sdp_discovery.c
View File

@@ -90,7 +90,7 @@ static UINT8 *sdpu_build_uuid_seq (UINT8 *p_out, UINT16 num_uuids, tSDP_UUID *p_
UINT32_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid32);
} else {
UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES);
ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, p_uuid_list->len);
ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, LEN_UUID_128);
}
}
@@ -374,6 +374,10 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
p = &p_ccb->rsp_list[0];
p_end = &p_ccb->rsp_list[0] + list_len;
if (cpy_len == 0) {
return;
}
if (offset) {
type = *p++;
cpy_len--;
@@ -835,7 +839,7 @@ static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end)
** Returns pointer to next byte in data stream
**
*******************************************************************************/
tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda)
static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda)
{
tSDP_DISC_REC *p_rec;
@@ -950,7 +954,7 @@ static UINT8 *add_attr (UINT8 *p, UINT8 *p_end, tSDP_DISCOVERY_DB *p_db, tSDP_DI
break;
}
}
/* Case falls through */
/* falls through */
case TWO_COMP_INT_DESC_TYPE:
switch (attr_len) {

13
components/bt/host/bluedroid/stack/sdp/sdp_main.c
View File

@@ -28,7 +28,6 @@
#include "common/bt_target.h"
#include "osi/allocator.h"
#include "stack/l2cdefs.h"
#include "stack/hcidefs.h"
#include "stack/hcimsgs.h"
@@ -138,6 +137,10 @@ void sdp_init (void)
{
#if SDP_DYNAMIC_MEMORY
sdp_cb_ptr = (tSDP_CB *)osi_malloc(sizeof(tSDP_CB));
if (!sdp_cb_ptr) {
ESP_LOGE("BT_SDP", "SDP control block malloc failed\n");
return;
}
#endif /* #if SDP_DYNAMIC_MEMORY */
/* Clears all structures and local SDP database (if Server is enabled) */
memset (&sdp_cb, 0, sizeof (tSDP_CB));
@@ -208,8 +211,10 @@ void sdp_deinit (void)
{
list_free(sdp_cb.server_db.p_record_list);
#if SDP_DYNAMIC_MEMORY
osi_free(sdp_cb_ptr);
sdp_cb_ptr = NULL;
if (sdp_cb_ptr) {
osi_free(sdp_cb_ptr);
sdp_cb_ptr = NULL;
}
#endif /* #if SDP_DYNAMIC_MEMORY */
}
@@ -403,7 +408,7 @@ static void sdp_config_ind (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg)
p_cfg->mtu_present = FALSE;
p_cfg->result = L2CAP_CFG_OK;
/* Check peer config request against our rfcomm configuration */
/* Check peer config request against our sdp configuration */
if (p_cfg->fcr_present) {
/* Reject the window size if it is bigger than we want it to be */
if (p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE) {

63
components/bt/host/bluedroid/stack/sdp/sdp_server.c
View File

@@ -344,13 +344,18 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN;
}
p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq);
p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq);
if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST);
return;
}
if (max_list_len < 4) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);
return;
}
memcpy(&attr_seq_sav, &attr_seq, sizeof(tSDP_ATTR_SEQ)) ;
/* Find a record with the record handle */
@@ -375,31 +380,32 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
p_ccb->rsp_list = (UINT8 *)osi_malloc(max_list_len);
if (p_ccb->rsp_list == NULL) {
SDP_TRACE_ERROR("%s No scratch buf for attr rsp\n", __func__);
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
return;
}
if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
BE_STREAM_TO_UINT16 (cont_offset, p_req);
if (cont_offset != p_ccb->cont_offset) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
if (!p_ccb->rsp_list) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
return;
}
is_cont = TRUE;
/* Initialise for continuation response */
p_rsp = &p_ccb->rsp_list[0];
attr_seq.attr_entry[p_ccb->cont_info.next_attr_index].start = p_ccb->cont_info.next_attr_start_id;
} else {
if (p_ccb->rsp_list) {
if (p_ccb->rsp_list) {
osi_free (p_ccb->rsp_list);
}
@@ -438,6 +444,12 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (p_ccb->cont_info.attr_offset) {
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* If the partial attrib could not been fully added yet */
if (p_ccb->cont_info.attr_offset != attr_len) {
@@ -449,12 +461,20 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (attr_len >= SDP_MAX_ATTR_LEN) {
SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len);
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* add the partial attribute if possible */
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_ccb->cont_info.next_attr_index = xx;
p_ccb->cont_info.next_attr_start_id = p_attr->id;
@@ -502,6 +522,8 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
/* Get a buffer to use to build the response */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_buf->offset = L2CAP_MIN_OFFSET;
@@ -574,7 +596,6 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
BOOLEAN maxxed_out = FALSE, is_cont = FALSE;
UINT8 *p_seq_start;
UINT16 seq_len, attr_len;
UNUSED(p_req_end);
/* Extract the UUID sequence to search for */
p_req = sdpu_extract_uid_seq (p_req, param_len, &uid_seq);
@@ -591,9 +612,9 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
max_list_len = p_ccb->rem_mtu_size - SDP_MAX_SERVATTR_RSPHDR_LEN;
}
p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq);
p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq);
if ((!p_req) || (!attr_seq.num_attr)) {
if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST);
return;
}
@@ -625,17 +646,23 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN);
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
BE_STREAM_TO_UINT16 (cont_offset, p_req);
if (cont_offset != p_ccb->cont_offset) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX);
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
if (!p_ccb->rsp_list) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
is_cont = TRUE;
@@ -704,6 +731,12 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (p_ccb->cont_info.attr_offset) {
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* If the partial attrib could not been fully added yet */
if (p_ccb->cont_info.attr_offset != attr_len) {
@@ -716,12 +749,20 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
if (attr_len >= SDP_MAX_ATTR_LEN) {
SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len);
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
/* add the partial attribute if possible */
p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len,
&p_ccb->cont_info.attr_offset);
if (p_rsp == NULL) {
sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_ccb->cont_info.next_attr_index = xx;
p_ccb->cont_info.next_attr_start_id = p_attr->id;
@@ -791,6 +832,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
// TODO(sharvil): rewrite SDP server.
if (is_cont && len_to_send == 0) {
sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE, NULL);
osi_free(p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
@@ -817,6 +860,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num,
/* Get a buffer to use to build the response */
if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) {
SDP_TRACE_ERROR ("SDP - no buf for search rsp\n");
osi_free (p_ccb->rsp_list);
p_ccb->rsp_list = NULL;
return;
}
p_buf->offset = L2CAP_MIN_OFFSET;

125
components/bt/host/bluedroid/stack/sdp/sdp_utils.c
View File

@@ -361,6 +361,8 @@ void sdpu_build_n_send_error (tCONN_CB *p_ccb, UINT16 trans_num, UINT16 error_co
UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
{
UINT8 *p_seq_end;
UINT8 *p_param_start;
UINT8 *p_param_end;
UINT8 descr, type, size;
UINT32 seq_len, uuid_len;
@@ -368,7 +370,12 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
p_seq->num_uids = 0;
/* A UID sequence is composed of a bunch of UIDs. */
p_param_start = p;
p_param_end = p_param_start + param_len;
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -388,26 +395,38 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
seq_len = 16;
break;
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (seq_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT16 (seq_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT32 (seq_len, p);
break;
default:
return (NULL);
}
if (seq_len >= param_len) {
p_seq_end = p + seq_len;
if (p_seq_end < p || p_seq_end > p_param_end) {
return (NULL);
}
p_seq_end = p + seq_len;
/* Loop through, extracting the UIDs */
for ( ; p < p_seq_end ; ) {
if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -427,31 +446,37 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
uuid_len = 16;
break;
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_seq_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (uuid_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_seq_end) {
return (NULL);
}
BE_STREAM_TO_UINT16 (uuid_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_seq_end) {
return (NULL);
}
BE_STREAM_TO_UINT32 (uuid_len, p);
break;
default:
return (NULL);
}
/* If UUID length is valid, copy it across */
if ((uuid_len == 2) || (uuid_len == 4) || (uuid_len == 16)) {
p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len;
BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len);
p_seq->num_uids++;
} else {
if ((uuid_len != 2) && (uuid_len != 4) && (uuid_len != 16)) {
return (NULL);
}
if (p + uuid_len > p_seq_end) {
return (NULL);
}
/* We can only do so many */
if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) {
return (NULL);
}
p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len;
BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len);
p_seq->num_uids++;
}
if (p != p_seq_end) {
@@ -476,13 +501,22 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq)
UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
{
UINT8 *p_end_list;
UINT8 *p_param_start;
UINT8 *p_param_end;
UINT8 descr, type, size;
UINT32 list_len, attr_len;
/* Assume none found */
p_seq->num_attr = 0;
/* param_len is bytes available from p through end of SDP parameter block */
p_param_start = p;
p_param_end = p_param_start + param_len;
/* Get attribute sequence info */
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -493,14 +527,23 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
switch (size) {
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT8 (list_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT16 (list_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_param_end) {
return (NULL);
}
BE_STREAM_TO_UINT32 (list_len, p);
break;
@@ -508,14 +551,17 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
return (p);
}
if (list_len > param_len) {
return (p);
}
p_end_list = p + list_len;
if (p_end_list < p || p_end_list > p_param_end) {
return (NULL);
}
/* Loop through, extracting the attribute IDs */
for ( ; p < p_end_list ; ) {
if (p_seq->num_attr >= MAX_ATTR_PER_SEQ) {
return (NULL);
}
BE_STREAM_TO_UINT8 (descr, p);
type = descr >> 3;
size = descr & 7;
@@ -532,34 +578,45 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq)
attr_len = 4;
break;
case SIZE_IN_NEXT_BYTE:
if (p + 1 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT8 (attr_len, p);
break;
case SIZE_IN_NEXT_WORD:
if (p + 2 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT16 (attr_len, p);
break;
case SIZE_IN_NEXT_LONG:
if (p + 4 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT32 (attr_len, p);
break;
default:
return (NULL);
break;
}
/* Attribute length must be 2-bytes or 4-bytes for a paired entry. */
if (attr_len == 2) {
if (p + 2 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p);
p_seq->attr_entry[p_seq->num_attr].end = p_seq->attr_entry[p_seq->num_attr].start;
} else if (attr_len == 4) {
if (p + 4 > p_end_list) {
return (NULL);
}
BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p);
BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].end, p);
} else {
return (NULL);
}
/* We can only do so many */
if (++p_seq->num_attr >= MAX_ATTR_PER_SEQ) {
return (NULL);
}
p_seq->num_attr++;
}
return (p);
@@ -995,6 +1052,25 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI
UINT8 *p_tmp_attr;
size_t len_to_copy;
UINT16 attr_len;
UINT16 rem_in_attr;
attr_len = sdpu_get_attrib_entry_len(p_attr);
if (attr_len > SDP_MAX_ATTR_LEN) {
SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: attr_len %u exceeds SDP_MAX_ATTR_LEN %u\n",
attr_len, (UINT16)SDP_MAX_ATTR_LEN);
return NULL;
}
if (*offset > attr_len) {
SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: offset %u past attr_len %u\n", *offset, attr_len);
return NULL;
}
rem_in_attr = (UINT16)(attr_len - *offset);
len_to_copy = (size_t)((rem_in_attr < len) ? rem_in_attr : len);
/* rem_in_attr is 0 when *offset == attr_len; avoid memcpy(0) issues and useless work */
if (len_to_copy == 0) {
return p_out;
}
if ((p_attr_buff = (UINT8 *) osi_malloc(sizeof(UINT8) * SDP_MAX_ATTR_LEN )) == NULL) {
SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry cannot get a buffer!\n");
@@ -1003,14 +1079,11 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI
p_tmp_attr = p_attr_buff;
sdpu_build_attrib_entry(p_tmp_attr, p_attr);
attr_len = sdpu_get_attrib_entry_len(p_attr);
len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset) : len;
memcpy(p_out, &p_attr_buff[*offset], len_to_copy);
p_out = &p_out[len_to_copy];
*offset += len_to_copy;
*offset += (UINT16)len_to_copy;
osi_free(p_attr_buff);
return p_out;

10
components/bt/host/bluedroid/stack/smp/smp_br_main.c
View File

@@ -37,7 +37,7 @@ const char *const smp_br_event_name [SMP_BR_MAX_EVT] = {
"BR_CONFIRM_EVT",
"BR_RAND_EVT",
"BR_PAIRING_FAILED_EVT",
"BR_ENCRPTION_INFO_EVT",
"BR_ENCRYPTION_INFO_EVT",
"BR_MASTER_ID_EVT",
"BR_ID_INFO_EVT",
"BR_ID_ADDR_EVT",
@@ -316,7 +316,13 @@ void smp_br_state_machine_event(tSMP_CB *p_cb, tSMP_BR_EVENT event, void *p_data
tSMP_BR_STATE curr_state = p_cb->br_state;
tSMP_BR_SM_TBL state_table;
UINT8 action, entry;
tSMP_BR_ENTRY_TBL entry_table = smp_br_entry_table[p_cb->role];
tSMP_BR_ENTRY_TBL entry_table = NULL;
if (p_cb->role > HCI_ROLE_SLAVE) {
SMP_TRACE_ERROR("Invalid role: %d", p_cb->role);
return;
}
entry_table = smp_br_entry_table[p_cb->role];
SMP_TRACE_EVENT("main %s", __func__);
if (curr_state >= SMP_BR_STATE_MAX) {