From d429d5d11698c87817defcfdb94d4df0f1ec2de6 Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Mon, 30 Mar 2026 16:57:32 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid --- .../bt/host/bluedroid/api/esp_bt_device.c | 10 +- .../bt/host/bluedroid/api/esp_bt_main.c | 46 ++++--- .../bt/host/bluedroid/api/esp_gap_bt_api.c | 126 +++++++++--------- .../bt/host/bluedroid/api/esp_sdp_api.c | 10 +- .../bt/host/bluedroid/bta/dm/bta_dm_pm.c | 12 +- .../bt/host/bluedroid/bta/dm/bta_dm_qos.c | 4 +- .../bt/host/bluedroid/bta/dm/bta_dm_sco.c | 12 +- .../bt/host/bluedroid/bta/sdp/bta_sdp.c | 2 +- .../bt/host/bluedroid/bta/sdp/bta_sdp_act.c | 2 +- .../bt/host/bluedroid/bta/sdp/bta_sdp_api.c | 4 + .../bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c | 2 +- .../btc/profile/std/gap/bta_gap_bt_co.c | 14 +- .../btc/profile/std/gap/btc_gap_bt.c | 10 +- .../bluedroid/btc/profile/std/sdp/btc_sdp.c | 38 ++++-- .../bt/host/bluedroid/stack/btm/btm_sco.c | 64 ++++++--- .../bt/host/bluedroid/stack/gap/gap_conn.c | 24 ++-- .../bt/host/bluedroid/stack/l2cap/l2c_csm.c | 3 +- .../bt/host/bluedroid/stack/l2cap/l2c_fcr.c | 26 ++-- .../bt/host/bluedroid/stack/l2cap/l2c_ucd.c | 7 +- .../host/bluedroid/stack/l2cap/l2cap_client.c | 7 + .../bt/host/bluedroid/stack/sdp/sdp_api.c | 12 +- .../bt/host/bluedroid/stack/sdp/sdp_db.c | 27 ++-- .../host/bluedroid/stack/sdp/sdp_discovery.c | 10 +- .../bt/host/bluedroid/stack/sdp/sdp_main.c | 13 +- .../bt/host/bluedroid/stack/sdp/sdp_server.c | 63 +++++++-- .../bt/host/bluedroid/stack/sdp/sdp_utils.c | 125 +++++++++++++---- .../bt/host/bluedroid/stack/smp/smp_br_main.c | 10 +- 27 files changed, 438 insertions(+), 245 deletions(-) diff --git a/components/bt/host/bluedroid/api/esp_bt_device.c b/components/bt/host/bluedroid/api/esp_bt_device.c index d3229e5f5c7..bbd56cac986 100644 --- a/components/bt/host/bluedroid/api/esp_bt_device.c +++ b/components/bt/host/bluedroid/api/esp_bt_device.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -16,9 +16,7 @@ esp_err_t esp_bt_dev_register_callback(esp_bt_dev_cb_t callback) { - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (callback == NULL) { return ESP_ERR_INVALID_ARG; @@ -31,7 +29,7 @@ esp_err_t esp_bt_dev_register_callback(esp_bt_dev_cb_t callback) const uint8_t *esp_bt_dev_get_address(void) { if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return NULL; + return NULL; } return controller_get_interface()->get_address()->address; } @@ -97,6 +95,8 @@ esp_err_t esp_bt_dev_coex_status_config(esp_bt_dev_coex_type_t type, esp_bt_dev_ esp_err_t esp_bt_config_file_path_get(char *file_path) { + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + return btc_config_file_path_get(file_path); } diff --git a/components/bt/host/bluedroid/api/esp_bt_main.c b/components/bt/host/bluedroid/api/esp_bt_main.c index 55cd9e3caee..0d79ec2b9d8 100644 --- a/components/bt/host/bluedroid/api/esp_bt_main.c +++ b/components/bt/host/bluedroid/api/esp_bt_main.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -31,19 +31,19 @@ esp_err_t esp_bluedroid_enable(void) future_t **future_p; if (s_bt_host_state == ESP_BLUEDROID_STATUS_UNINITIALIZED) { - LOG_ERROR("Bludroid not initialised\n"); + LOG_ERROR("Bluedroid not initialised"); return ESP_ERR_INVALID_STATE; } if (s_bt_host_state == ESP_BLUEDROID_STATUS_ENABLED) { - LOG_ERROR("Bluedroid already enabled\n"); + LOG_ERROR("Bluedroid already enabled"); return ESP_ERR_INVALID_STATE; } future_p = btc_main_get_future_p(BTC_MAIN_ENABLE_FUTURE); *future_p = future_new(); if (*future_p == NULL) { - LOG_ERROR("Bluedroid enable failed\n"); + LOG_ERROR("Bluedroid enable failed"); return ESP_ERR_NO_MEM; } @@ -53,12 +53,13 @@ esp_err_t esp_bluedroid_enable(void) if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { future_free(*future_p); - LOG_ERROR("Bluedroid enable failed\n"); + *future_p = NULL; + LOG_ERROR("Bluedroid enable failed"); return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { - LOG_ERROR("Bluedroid enable failed\n"); + LOG_ERROR("Bluedroid enable failed"); return ESP_FAIL; } @@ -72,7 +73,7 @@ esp_err_t esp_bluedroid_disable(void) future_t **future_p; if (s_bt_host_state != ESP_BLUEDROID_STATUS_ENABLED) { - LOG_ERROR("Bluedroid already disabled\n"); + LOG_ERROR("Bluedroid already disabled"); return ESP_ERR_INVALID_STATE; } @@ -81,7 +82,7 @@ esp_err_t esp_bluedroid_disable(void) future_p = btc_main_get_future_p(BTC_MAIN_DISABLE_FUTURE); *future_p = future_new(); if (*future_p == NULL) { - LOG_ERROR("Bluedroid disable failed\n"); + LOG_ERROR("Bluedroid disable failed"); s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED; return ESP_ERR_NO_MEM; } @@ -91,14 +92,15 @@ esp_err_t esp_bluedroid_disable(void) msg.act = BTC_MAIN_ACT_DISABLE; if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { - LOG_ERROR("Bluedroid disable failed\n"); + LOG_ERROR("Bluedroid disable failed"); future_free(*future_p); + *future_p = NULL; s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED; return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { - LOG_ERROR("Bluedroid disable failed\n"); + LOG_ERROR("Bluedroid disable failed"); s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED; return ESP_FAIL; } @@ -126,28 +128,28 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) if (cfg->sc_en) { #if (SC_MODE_INCLUDED == FALSE) - LOG_ERROR("Secure Connections should not be enabled when target controller is ESP32.\n"); - LOG_ERROR("It may trigger unresolved bugs in the controller.\n"); + LOG_ERROR("Secure Connections should not be enabled when target controller is ESP32."); + LOG_ERROR("It may trigger unresolved bugs in the controller."); return ESP_ERR_INVALID_ARG; #endif // SC_MODE_INCLUDED if (!cfg->ssp_en) { - LOG_ERROR("secure simple pairing should be enabled when secure connection host support is enabled\n"); + LOG_ERROR("secure simple pairing should be enabled when secure connection host support is enabled"); return ESP_ERR_INVALID_ARG; } - LOG_WARN("Please make sure to clear the bond list before enabling the secure connection host support\n"); + LOG_WARN("Please make sure to clear the bond list before enabling the secure connection host support"); } #if (BT_CONTROLLER_INCLUDED == TRUE) if (esp_bt_controller_get_status() != ESP_BT_CONTROLLER_STATUS_ENABLED) { - LOG_ERROR("Controller not initialised\n"); + LOG_ERROR("Controller not initialised"); return ESP_ERR_INVALID_STATE; } #endif if (s_bt_host_state != ESP_BLUEDROID_STATUS_UNINITIALIZED) { - LOG_ERROR("Bluedroid already initialised\n"); + LOG_ERROR("Bluedroid already initialised"); return ESP_ERR_INVALID_STATE; } @@ -205,6 +207,7 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { LOG_ERROR("Bluedroid Initialize Fail"); future_free(*future_p); + *future_p = NULL; btc_deinit(); bluedroid_config_deinit(); #if HEAP_MEMORY_STATS @@ -238,20 +241,20 @@ esp_err_t esp_bluedroid_deinit(void) future_t **future_p; if (s_bt_host_state == ESP_BLUEDROID_STATUS_UNINITIALIZED) { - LOG_ERROR("Bluedroid already de-initialised\n"); + LOG_ERROR("Bluedroid already de-initialised"); return ESP_ERR_INVALID_STATE; } if (s_bt_host_state == ESP_BLUEDROID_STATUS_ENABLED || s_bt_host_state == ESP_BLUEDROID_STATUS_DISABLING) { - LOG_ERROR("Bludroid still enabled or stopping, disable first\n"); + LOG_ERROR("Bluedroid still enabled or stopping, disable first"); return ESP_ERR_INVALID_STATE; } future_p = btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE); *future_p = future_new(); if (*future_p == NULL) { - LOG_ERROR("Bluedroid de-initialise failed\n"); + LOG_ERROR("Bluedroid de-initialise failed"); return ESP_ERR_NO_MEM; } @@ -260,13 +263,14 @@ esp_err_t esp_bluedroid_deinit(void) msg.act = BTC_MAIN_ACT_DEINIT; if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { - LOG_ERROR("Bluedroid de-initialise failed\n"); + LOG_ERROR("Bluedroid de-initialise failed"); future_free(*future_p); + *future_p = NULL; return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { - LOG_ERROR("Bluedroid de-initialise failed\n"); + LOG_ERROR("Bluedroid de-initialise failed"); return ESP_FAIL; } diff --git a/components/bt/host/bluedroid/api/esp_gap_bt_api.c b/components/bt/host/bluedroid/api/esp_gap_bt_api.c index 200630e11ab..49a3acd9727 100644 --- a/components/bt/host/bluedroid/api/esp_gap_bt_api.c +++ b/components/bt/host/bluedroid/api/esp_gap_bt_api.c @@ -22,9 +22,7 @@ esp_err_t esp_bt_gap_register_callback(esp_bt_gap_cb_t callback) { - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (callback == NULL) { return ESP_FAIL; @@ -39,9 +37,7 @@ esp_err_t esp_bt_gap_set_scan_mode(esp_bt_connection_mode_t c_mode, esp_bt_disco btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -57,9 +53,7 @@ esp_err_t esp_bt_gap_start_discovery(esp_bt_inq_mode_t mode, uint8_t inq_len, ui btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (mode != ESP_BT_INQ_MODE_GENERAL_INQUIRY && mode != ESP_BT_INQ_MODE_LIMITED_INQUIRY) { @@ -86,9 +80,7 @@ esp_err_t esp_bt_gap_cancel_discovery(void) { btc_msg_t msg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -102,9 +94,7 @@ esp_err_t esp_bt_gap_get_remote_services(esp_bd_addr_t remote_bda) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -119,8 +109,10 @@ esp_err_t esp_bt_gap_get_remote_service_record(esp_bd_addr_t remote_bda, esp_bt_ btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if (uuid == NULL) { + return ESP_ERR_INVALID_ARG; } msg.sig = BTC_SIG_API_CALL; @@ -166,9 +158,7 @@ esp_err_t esp_bt_gap_config_eir_data(esp_bt_eir_data_t *eir_data) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (eir_data == NULL) { return ESP_ERR_INVALID_ARG; @@ -199,9 +189,7 @@ esp_err_t esp_bt_gap_set_cod(esp_bt_cod_t cod, esp_bt_cod_mode_t mode) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); switch (mode) { case ESP_BT_SET_COD_RESERVED_2: @@ -236,6 +224,9 @@ esp_err_t esp_bt_gap_read_rssi_delta(esp_bd_addr_t remote_addr) { btc_msg_t msg; btc_gap_bt_args_t arg; + + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_READ_RSSI_DELTA; @@ -250,6 +241,8 @@ esp_err_t esp_bt_gap_read_acl_real_rssi(esp_bd_addr_t remote_addr) btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_READ_ACL_REAL_RSSI; @@ -262,6 +255,8 @@ esp_err_t esp_bt_gap_read_new_conn_tx_pwr_rng(void) { btc_msg_t msg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_READ_NEW_CONN_TX_PWR_LVL; @@ -274,6 +269,8 @@ esp_err_t esp_bt_gap_write_new_conn_tx_pwr_rng(int8_t pwr_lvl_min, int8_t pwr_lv btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (pwr_lvl_min < ESP_TX_PWR_LVL_MIN || pwr_lvl_min > ESP_TX_PWR_LVL_MAX || pwr_lvl_max < ESP_TX_PWR_LVL_MIN || pwr_lvl_max > ESP_TX_PWR_LVL_MAX || pwr_lvl_min > pwr_lvl_max) { @@ -295,6 +292,8 @@ esp_err_t esp_bt_gap_read_tx_pwr_lvl(esp_bt_gap_tx_pwr_lvl_type_t type) btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + #if (ESP_BT_CLASSIC_ENABLE_POWER_CTRL_VSC == TRUE) if (type >= ESP_BT_GAP_TX_PWR_LVL_TYPE_MAX) { return ESP_ERR_INVALID_ARG; @@ -318,6 +317,8 @@ esp_err_t esp_bt_gap_write_tx_pwr_lvl(esp_bt_gap_tx_pwr_lvl_type_t type, int8_t btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + #if (ESP_BT_CLASSIC_ENABLE_POWER_CTRL_VSC == TRUE) if (type >= ESP_BT_GAP_TX_PWR_LVL_TYPE_MAX || tx_power < ESP_TX_PWR_LVL_MIN || tx_power > ESP_TX_PWR_LVL_MAX) { @@ -346,9 +347,7 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -360,9 +359,8 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr) int esp_bt_gap_get_bond_device_num(void) { - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + return btc_storage_get_num_bt_bond_devices(); } @@ -370,14 +368,12 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list) { int ret; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (dev_num == NULL || dev_list == NULL) { return ESP_ERR_INVALID_ARG; } - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } - ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, dev_num); return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -388,8 +384,12 @@ esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, e btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if (pin_type == ESP_BT_PIN_TYPE_FIXED) { + if ((pin_code == NULL) || (pin_code_len == 0) || (pin_code_len > ESP_BT_PIN_CODE_LEN)) { + return ESP_ERR_INVALID_ARG; + } } msg.sig = BTC_SIG_API_CALL; @@ -413,17 +413,22 @@ esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_c btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if (accept && ((pin_code == NULL) || (pin_code_len == 0) || (pin_code_len > ESP_BT_PIN_CODE_LEN))) { + return ESP_ERR_INVALID_ARG; } + memset(&arg, 0, sizeof(btc_gap_bt_args_t)); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_PIN_REPLY; arg.pin_reply.accept = accept; - arg.pin_reply.pin_code_len = pin_code_len; memcpy(arg.pin_reply.bda.address, bd_addr, sizeof(esp_bd_addr_t)); - memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len); + if (accept) { + arg.pin_reply.pin_code_len = pin_code_len; + memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len); + } return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), btc_gap_bt_arg_deep_copy, btc_gap_bt_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -435,8 +440,11 @@ esp_err_t esp_bt_gap_set_security_param(esp_bt_sp_param_t param_type, btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if ((param_type > ESP_BT_SP_IOCAP_MODE) || (value == NULL) || + ((param_type == ESP_BT_SP_IOCAP_MODE) && (len < 1))) { + return ESP_ERR_INVALID_ARG; } if (!(bluedroid_config_get()->get_ssp_enabled())) { @@ -460,9 +468,7 @@ esp_err_t esp_bt_gap_ssp_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint3 btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (!(bluedroid_config_get()->get_ssp_enabled())) { ESP_LOGE(TAG, "%s is not supported when `ssp_en` in `esp_bluedroid_config_t` is disabled!", __func__); @@ -484,9 +490,7 @@ esp_err_t esp_bt_gap_ssp_confirm_reply(esp_bd_addr_t bd_addr, bool accept) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (!(bluedroid_config_get()->get_ssp_enabled())) { ESP_LOGE(TAG, "%s is not supported when `ssp_en` in `esp_bluedroid_config_t` is disabled!", __func__); @@ -507,9 +511,7 @@ esp_err_t esp_bt_gap_set_afh_channels(esp_bt_gap_afh_channels channels) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -525,9 +527,7 @@ esp_err_t esp_bt_gap_read_remote_name(esp_bd_addr_t remote_bda) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -542,9 +542,7 @@ esp_err_t esp_bt_gap_set_qos(esp_bd_addr_t remote_bda, uint32_t t_poll) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (t_poll < ESP_BT_GAP_TPOLL_MIN || t_poll > ESP_BT_GAP_TPOLL_MAX) { return ESP_ERR_INVALID_ARG; @@ -565,7 +563,7 @@ esp_err_t esp_bt_gap_set_page_timeout(uint16_t page_to) btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } if (page_to < HCI_MIN_PAGE_TOUT) { return ESP_ERR_INVALID_ARG; @@ -584,7 +582,7 @@ esp_err_t esp_bt_gap_get_page_timeout(void) btc_msg_t msg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } msg.sig = BTC_SIG_API_CALL; @@ -600,7 +598,7 @@ esp_err_t esp_bt_gap_set_acl_pkt_types(esp_bd_addr_t remote_bda, uint16_t pkt_ty btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } msg.sig = BTC_SIG_API_CALL; @@ -619,7 +617,7 @@ esp_err_t esp_bt_gap_set_min_enc_key_size(uint8_t key_size) btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } if (key_size < ESP_BT_ENC_KEY_SIZE_CTRL_MIN || key_size > ESP_BT_ENC_KEY_SIZE_CTRL_MAX) { @@ -641,7 +639,7 @@ esp_err_t esp_bt_gap_set_device_name(const char *name) btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } if ((!name) || (strlen(name) > BTC_MAX_LOC_BD_NAME_LEN)) { return ESP_ERR_INVALID_ARG; @@ -661,7 +659,7 @@ esp_err_t esp_bt_gap_get_device_name(void) btc_msg_t msg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } msg.sig = BTC_SIG_API_CALL; @@ -677,9 +675,7 @@ esp_err_t esp_bt_gap_get_profile_status(esp_bt_gap_profile_status_t *profile_sta return ESP_ERR_INVALID_ARG; } - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); memset(profile_status, 0, sizeof(esp_bt_gap_profile_status_t)); btc_gap_bt_status_get(profile_status); diff --git a/components/bt/host/bluedroid/api/esp_sdp_api.c b/components/bt/host/bluedroid/api/esp_sdp_api.c index 41e143a2ebc..6985b905d65 100644 --- a/components/bt/host/bluedroid/api/esp_sdp_api.c +++ b/components/bt/host/bluedroid/api/esp_sdp_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -36,13 +36,13 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record) case ESP_SDP_TYPE_MAP_MAS: if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) { LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n"); - ret = false; + ret = false; } break; case ESP_SDP_TYPE_PBAP_PSE: if (record->pse.supported_repositories >> 8) { LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n"); - ret = false; + ret = false; } break; @@ -50,7 +50,8 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record) break; } if (record->hdr.type != ESP_SDP_TYPE_DIP_SERVER) { - if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX || + if (record->hdr.service_name == NULL || + record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX || strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) { LOG_ERROR("Invalid server name!\n"); ret = false; @@ -167,6 +168,7 @@ esp_err_t esp_sdp_remove_record(int record_handle) msg.pid = BTC_PID_SDP; msg.act = BTC_SDP_ACT_REMOVE_RECORD; + memset(&arg, 0, sizeof(btc_sdp_args_t)); arg.remove_record.record_handle = record_handle; /* Switch to BTC context */ diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c b/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c index 74712870bfc..31e1405b0bd 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c @@ -433,10 +433,10 @@ static void bta_dm_pm_cback(tBTA_SYS_CONN_STATUS status, UINT8 id, UINT8 app_id, ((NULL != (p = BTM_ReadRemoteFeatures (peer_addr))) && HCI_SNIFF_SUB_RATE_SUPPORTED(p)) && (index == BTA_DM_PM_SSR0)) { if (status == BTA_SYS_SCO_OPEN) { - APPL_TRACE_DEBUG("%s: SCO inactive, reset SSR to zero", __func__); + APPL_TRACE_DEBUG("%s: SCO active, reset SSR to zero", __func__); BTM_SetSsrParams (peer_addr, 0, 0, 0 ); } else if (status == BTA_SYS_SCO_CLOSE) { - APPL_TRACE_DEBUG("%s: SCO active, back to old SSR", __func__); + APPL_TRACE_DEBUG("%s: SCO inactive, back to old SSR", __func__); bta_dm_pm_ssr(peer_addr); } } @@ -621,8 +621,8 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request, } return; } - /* if pending power mode timer expires, and currecnt link is in a - lower power mode than current profile requirement, igonre it */ + /* if pending power mode timer expires, and current link is in a + lower power mode than current profile requirement, ignore it */ if (pm_req == BTA_DM_PM_EXECUTE && pm_request < pm_action) { APPL_TRACE_ERROR("Ignore the power mode request: %d", pm_request) return; @@ -644,7 +644,7 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request, } /******************************************************************************* ** -** Function bta_ag_pm_park +** Function bta_dm_pm_park ** ** Description Switch to park mode. ** @@ -669,7 +669,7 @@ static BOOLEAN bta_dm_pm_park(BD_ADDR peer_addr) /******************************************************************************* ** -** Function bta_ag_pm_sniff +** Function bta_dm_pm_sniff ** ** Description Switch to sniff mode. ** diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c b/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c index 19a31b9449d..858f93cf6c0 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c @@ -33,7 +33,7 @@ void bta_dm_set_qos(tBTA_DM_MSG *p_data) { - FLOW_SPEC p_flow = { + FLOW_SPEC flow = { .qos_flags = 0, /* TBD */ .service_type = NO_TRAFFIC, /* service_type */ .token_rate = 0, /* bytes/second */ @@ -43,7 +43,7 @@ void bta_dm_set_qos(tBTA_DM_MSG *p_data) .delay_variation = 0xFFFFFFFF /* microseconds */ }; - tBTM_STATUS status = BTM_SetQoS (p_data->qos_set.bd_addr, &p_flow, p_data->qos_set.p_cb); + tBTM_STATUS status = BTM_SetQoS (p_data->qos_set.bd_addr, &flow, p_data->qos_set.p_cb); if(status != BTM_CMD_STARTED) { APPL_TRACE_ERROR("%s ERROR: 0x%x\n", __func__, status); diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c b/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c index df91799a872..c75e6476a21 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c @@ -20,7 +20,7 @@ * * This file contains the down sampling utility to convert PCM samples in * 16k/32k/48k/44.1k/22050/11025 sampling rate into 8K/16bits samples - * required for SCO channel format. One API function isprovided and only + * required for SCO channel format. One API function is provided and only * possible to be used when transmitting SCO data is sent via HCI * interface. * @@ -76,10 +76,12 @@ static tBTA_DM_PCM_RESAMPLE_CB* p_bta_dm_pcm_cb; #define CHECK_SATURATION16(x) \ + do { \ if (x > 32767) \ x = 32767; \ else if (x < -32768) \ - x = -32768; + x = -32768; \ + } while (0); //////////////////////////////////////////////////////////////////////////////////////////////////// // @@ -630,8 +632,10 @@ void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels) ** *******************************************************************************/ void BTA_DmPcmDeinitSamples(void) { - osi_free(p_bta_dm_pcm_cb); - p_bta_dm_pcm_cb = NULL; + if (p_bta_dm_pcm_cb) { + osi_free(p_bta_dm_pcm_cb); + p_bta_dm_pcm_cb = NULL; + } } /************************************************************************************** diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp.c index 71773d984c6..101934550d6 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp.c @@ -18,7 +18,7 @@ /****************************************************************************** * - * This is the main implementation file for the BTA MCE I/F + * This is the main implementation file for the BTA SDP I/F * ******************************************************************************/ diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c index 913eb7c45ea..b0b2ee13a3c 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c @@ -628,7 +628,7 @@ void bta_sdp_remove_record(tBTA_SDP_MSG *p_data) ** ** Function bta_sdp_disable ** -** Description Removes an SDP record +** Description Disable SDP ** ** Returns void ** diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c index a96b87fe15d..d670a5e33d1 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c @@ -157,6 +157,10 @@ tBTA_SDP_STATUS BTA_SdpSearch(BD_ADDR bd_addr, tSDP_UUID *uuid) tBTA_SDP_STATUS ret = BTA_SDP_FAILURE; tBTA_SDP_API_SEARCH *p_msg; + if (!uuid) { + return BTA_SDP_FAILURE; + } + APPL_TRACE_API("%s\n", __FUNCTION__); if ((p_msg = (tBTA_SDP_API_SEARCH *)osi_malloc(sizeof(tBTA_SDP_API_SEARCH))) != NULL) { p_msg->hdr.event = BTA_SDP_API_SEARCH_EVT; diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c index 423905bc50b..6e213048917 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c @@ -52,6 +52,6 @@ tBTA_SDP_CFG bta_sdp_cfg = { #endif }; -tBTA_SDP_CFG *p_bta_sdp_cfg = (tBTA_SDP_CFG *) &bta_sdp_cfg; +tBTA_SDP_CFG *p_bta_sdp_cfg = &bta_sdp_cfg; #endif /* #if defined(BTA_SDP_INCLUDED) && (BTA_SDP_INCLUDED == TRUE) */ diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c b/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c index e4c8ebd71c6..7dc955ffc39 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -11,9 +11,15 @@ #if (BTC_GAP_BT_INCLUDED == TRUE) void btc_gap_bt_config_eir_cmpl_callback (uint8_t status, uint8_t eir_type_num, uint8_t *eir_type) { - esp_bt_gap_cb_param_t param; + esp_bt_gap_cb_param_t param = {0}; + btc_msg_t msg = {0}; bt_status_t ret; - btc_msg_t msg; + + if (!eir_type || (eir_type_num > ESP_BT_EIR_TYPE_MAX_NUM)) { + BTC_TRACE_ERROR("%s invalid params", __func__); + return; + } + msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_CONFIG_EIR_DATA_EVT; @@ -26,7 +32,7 @@ void btc_gap_bt_config_eir_cmpl_callback (uint8_t status, uint8_t eir_type_num, sizeof(esp_bt_gap_cb_param_t), NULL, NULL); if (ret != BT_STATUS_SUCCESS) { - BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__); + BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__); } } #endif /// (BTC_GAP_BT_INCLUDED == TRUE) diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c index 9c95c7527f9..0bd3b0138f7 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c @@ -89,7 +89,6 @@ static void btc_bt_set_scan_mode(esp_bt_connection_mode_t c_mode, esp_bt_discove } BTA_DmSetVisibility(disc_mode, conn_mode, BTA_DM_IGNORE, BTA_DM_IGNORE); - return; } static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg) @@ -97,7 +96,7 @@ static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg) tBTA_DM_INQ inq_params; tBTA_SERVICE_MASK services = 0; - BTIF_TRACE_EVENT("%s", __FUNCTION__); + BTIF_TRACE_EVENT("%s", __func__); inq_params.mode = (arg->start_disc.mode == ESP_BT_INQ_MODE_GENERAL_INQUIRY) ? BTA_DM_GENERAL_INQUIRY : BTA_DM_LIMITED_INQUIRY; @@ -112,8 +111,6 @@ static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg) gap_bt_local_param.disc_stat = ESP_BT_GAP_DISCOVERY_STOPPED; /* find nearby devices */ BTA_DmSearch(&inq_params, services, bte_search_devices_evt); - - return; } static void btc_gap_bt_cancel_discovery(void) @@ -1342,7 +1339,6 @@ void btc_gap_bt_call_handler(btc_msg_t *msg) break; } btc_gap_bt_arg_deep_free(msg); - return; } void btc_gap_bt_busy_level_updated(uint8_t bl_flags) @@ -1407,7 +1403,7 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg) break; } default: - BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act); + BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __func__, msg->act); break; } } @@ -1527,7 +1523,7 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg) break; } default: - BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act); + BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __func__, msg->act); break; } btc_gap_bt_cb_deep_free(msg); diff --git a/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c b/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c index a124ed66e6c..964d375327a 100644 --- a/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c +++ b/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -353,21 +353,25 @@ static int free_sdp_slot(int id) sdp_slot_t *slot = NULL; if(id >= SDP_MAX_RECORDS) { - APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id); - return handle; - } - slot = sdp_local_param.sdp_slots[id]; - if (slot == NULL) { - // already freed + BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id); return handle; } osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT); + slot = sdp_local_param.sdp_slots[id]; + if (slot == NULL) { + osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex); + return handle; + } + handle = slot->sdp_handle; if (slot->state != SDP_RECORD_FREE) { /* safe a copy of the pointer, and free after unlock() */ record = slot->record_data; } + + osi_free(sdp_local_param.sdp_slots[id]); + sdp_local_param.sdp_slots[id] = NULL; osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex); if(record != NULL) { @@ -376,8 +380,6 @@ static int free_sdp_slot(int id) // Record have already been freed handle = -1; } - osi_free(sdp_local_param.sdp_slots[id]); - sdp_local_param.sdp_slots[id] = NULL; return handle; } @@ -623,7 +625,7 @@ static int add_mapc_sdp(const bluetooth_sdp_mns_record* rec) sdp_handle = 0; BTC_TRACE_ERROR("%s() FAILED", __func__); } else { - bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */ + bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_NOTIFICATION */ BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle); } @@ -703,7 +705,7 @@ static int add_pbaps_sdp(const bluetooth_sdp_pse_record* rec) sdp_handle = 0; BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status); } else { - bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */ + bta_sys_add_uuid(service); /* UUID_SERVCLASS_PBAP_PSE */ BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle); } @@ -749,7 +751,7 @@ static int add_pbapc_sdp(const bluetooth_sdp_pce_record* rec) sdp_handle = 0; BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status); } else { - bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */ + bta_sys_add_uuid(service); /* UUID_SERVCLASS_PBAP_PCE */ BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle); } @@ -1040,6 +1042,10 @@ static void btc_sdp_cb_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) tBTA_SDP_SEARCH_COMP *dest_search_comp = (tBTA_SDP_SEARCH_COMP *)p_dest; int record_count = src_search_comp->record_count; + if (record_count > BTA_SDP_MAX_RECORDS) { + record_count = BTA_SDP_MAX_RECORDS; + } + for (int i = 0; i < record_count; i++) { bluetooth_sdp_record *src_record = &src_search_comp->records[i]; bluetooth_sdp_record *dest_record = &dest_search_comp->records[i]; @@ -1091,7 +1097,12 @@ static void btc_sdp_cb_arg_deep_free(btc_msg_t *msg) switch (msg->act) { case BTA_SDP_SEARCH_COMP_EVT: { tBTA_SDP_SEARCH_COMP *search_comp = (tBTA_SDP_SEARCH_COMP *)msg->arg; - for (size_t i = 0; i < search_comp->record_count; i++) { + int record_count = search_comp->record_count; + if (record_count > BTA_SDP_MAX_RECORDS) { + record_count = BTA_SDP_MAX_RECORDS; + } + + for (size_t i = 0; i < record_count; i++) { bluetooth_sdp_record *record = &search_comp->records[i]; if (record->hdr.service_name) { osi_free(record->hdr.service_name); @@ -1416,7 +1427,6 @@ void btc_sdp_cb_handler(btc_msg_t *msg) int slot_id = get_sdp_slot_id_by_handle(p_data->sdp_remove_record.handle); if (slot_id < 0) { p_data->sdp_remove_record.status = ESP_SDP_NO_CREATE_RECORD; - break; } else { free_sdp_slot(slot_id); } diff --git a/components/bt/host/bluedroid/stack/btm/btm_sco.c b/components/bt/host/bluedroid/stack/btm/btm_sco.c index 6da0786eb33..30ca99f67fa 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_sco.c +++ b/components/bt/host/bluedroid/stack/btm/btm_sco.c @@ -24,7 +24,6 @@ ******************************************************************************/ #include -#include "stack/bt_types.h" #include "common/bt_target.h" #include "stack/bt_types.h" #include "stack/hcimsgs.h" @@ -405,10 +404,13 @@ static void btm_pkt_stat_nums_update(uint16_t sco_inx, uint8_t pkt_status) *******************************************************************************/ static void btm_pkt_stat_send_nums_update(uint16_t sco_inx, uint8_t pkt_status) { - tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; - p_ccb->pkt_stat_nums.tx_total++; - if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) { - p_ccb->pkt_stat_nums.tx_discarded++; + tSCO_CONN *p_ccb = NULL; + if (sco_inx < BTM_MAX_SCO_LINKS) { + p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; + p_ccb->pkt_stat_nums.tx_total++; + if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) { + p_ccb->pkt_stat_nums.tx_discarded++; + } } } @@ -461,6 +463,7 @@ void btm_route_sco_data(BT_HDR *p_msg) #if BTM_SCO_HCI_INCLUDED == TRUE UINT16 sco_inx, handle; UINT8 *p = (UINT8 *)(p_msg + 1) + p_msg->offset; + UINT16 len = p_msg->len; UINT8 pkt_size = 0; UINT8 pkt_status = 0; @@ -470,12 +473,12 @@ void btm_route_sco_data(BT_HDR *p_msg) handle = HCID_GET_HANDLE (handle); STREAM_TO_UINT8 (pkt_size, p); + UNUSED(len); UNUSED(pkt_size); if ((sco_inx = btm_find_scb_by_handle(handle)) != BTM_MAX_SCO_LINKS ) { /* send data callback */ - if (!btm_cb.sco_cb.p_data_cb ) + if (!btm_cb.sco_cb.p_data_cb) { /* if no data callback registered, just free the buffer */ - { osi_free (p_msg); } else { btm_pkt_stat_nums_update(sco_inx, pkt_status); @@ -484,7 +487,7 @@ void btm_route_sco_data(BT_HDR *p_msg) } else { /* no mapping handle SCO connection is active, free the buffer */ osi_free (p_msg); } - BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, p_msg->len, pkt_size); + BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, len, pkt_size); #else osi_free(p_msg); #endif @@ -516,12 +519,13 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf) { APPL_TRACE_DEBUG("%s", __FUNCTION__); #if (BTM_SCO_HCI_INCLUDED == TRUE) && (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p_ccb = NULL; UINT8 *p; tBTM_STATUS status = BTM_SUCCESS; if (sco_inx < BTM_MAX_SCO_LINKS && btm_cb.sco_cb.p_data_cb && - p_ccb->state == SCO_ST_CONNECTED) { + btm_cb.sco_cb.sco_db[sco_inx].state == SCO_ST_CONNECTED) { + p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; /* Ensure we have enough space in the buffer for the SCO and HCI headers */ if (p_buf->offset < HCI_SCO_PREAMBLE_SIZE) { BTM_TRACE_ERROR ("BTM SCO - cannot send buffer, offset: %d", p_buf->offset); @@ -557,8 +561,12 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf) } } } else { - BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]", - sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state); + if (sco_inx < BTM_MAX_SCO_LINKS) { + BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]", + sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state); + } else { + BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d", sco_inx); + } status = BTM_UNKNOWN_ADDR; } @@ -566,7 +574,9 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf) BTM_TRACE_WARNING ("stat %d", status); osi_free(p_buf); } - btm_pkt_stat_send_nums_update(sco_inx, status); + if (sco_inx < BTM_MAX_SCO_LINKS) { + btm_pkt_stat_send_nums_update(sco_inx, status); + } return (status); #else @@ -722,8 +732,13 @@ void btm_accept_sco_link(UINT16 sco_inx, tBTM_ESCO_PARAMS *p_setup, ** Returns void ** *******************************************************************************/ -void btm_reject_sco_link( UINT16 sco_inx ) +void btm_reject_sco_link( UINT16 sco_inx) { + if (sco_inx >= BTM_MAX_SCO_LINKS) { + BTM_TRACE_ERROR("btm_reject_sco_link: Invalid sco_inx(%d)", sco_inx); + return; + } + btm_esco_conn_rsp(sco_inx, HCI_ERR_HOST_REJECT_RESOURCES, btm_cb.sco_cb.sco_db[sco_inx].esco.data.bd_addr, NULL); } @@ -1373,10 +1388,12 @@ tBTM_STATUS BTM_SetScoPacketTypes (UINT16 sco_inx, UINT16 pkt_types) UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p = NULL; /* Validity check */ - if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) { + if ((sco_inx < BTM_MAX_SCO_LINKS) && + ((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && + (p->state == SCO_ST_CONNECTED)) { return (p->esco.setup.packet_types); } else { return (0); @@ -1425,10 +1442,12 @@ UINT16 BTM_ReadDeviceScoPacketTypes (void) UINT16 BTM_ReadScoHandle (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p = NULL;; /* Validity check */ - if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) { + if ((sco_inx < BTM_MAX_SCO_LINKS) && + ((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && + (p->state == SCO_ST_CONNECTED)) { return (p->hci_handle); } else { return (BTM_INVALID_HCI_HANDLE); @@ -1451,10 +1470,11 @@ UINT16 BTM_ReadScoHandle (UINT16 sco_inx) UINT8 *BTM_ReadScoBdAddr (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p = NULL; /* Validity check */ - if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->rem_bd_known)) { + if ((sco_inx < BTM_MAX_SCO_LINKS) && + ((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && (p->rem_bd_known)) { return (p->esco.data.bd_addr); } else { return (NULL); @@ -1538,7 +1558,9 @@ tBTM_STATUS BTM_RegForEScoEvts (UINT16 sco_inx, tBTM_ESCO_CBACK *p_esco_cback) { #if (BTM_MAX_SCO_LINKS>0) if (!btm_cb.sco_cb.esco_supported) { - btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL; + if (sco_inx < BTM_MAX_SCO_LINKS) { + btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL; + } return (BTM_MODE_UNSUPPORTED); } diff --git a/components/bt/host/bluedroid/stack/gap/gap_conn.c b/components/bt/host/bluedroid/stack/gap/gap_conn.c index 025f2ac1342..61a4684daf8 100644 --- a/components/bt/host/bluedroid/stack/gap/gap_conn.c +++ b/components/bt/host/bluedroid/stack/gap/gap_conn.c @@ -304,15 +304,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1 if (!p_ccb) { return (GAP_ERR_BAD_HANDLE); } + if (!p_len) { + return (GAP_ERR_ILL_PARM); + } *p_len = 0; + osi_mutex_global_lock(); + if (fixed_queue_is_empty(p_ccb->rx_queue)) { + osi_mutex_global_unlock(); return (GAP_NO_DATA_AVAIL); } - osi_mutex_global_lock(); - while (max_len) { BT_HDR *p_buf = fixed_queue_try_peek_first(p_ccb->rx_queue); if (p_buf == NULL) { @@ -359,19 +363,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1 int GAP_GetRxQueueCnt (UINT16 handle, UINT32 *p_rx_queue_count) { tGAP_CCB *p_ccb; - int rc = BT_PASS; + int rc = GAP_INVALID_HANDLE; + + if (!p_rx_queue_count) { + return GAP_ERR_ILL_PARM; + } /* Check that handle is valid */ - if (handle < GAP_MAX_CONNECTIONS) { - p_ccb = &gap_cb.conn.ccb_pool[handle]; - + p_ccb = gap_find_ccb_by_handle (handle); + if (p_ccb) { if (p_ccb->con_state == GAP_CCB_STATE_CONNECTED) { *p_rx_queue_count = p_ccb->rx_queue_size; - } else { - rc = GAP_INVALID_HANDLE; + rc = BT_PASS; } - } else { - rc = GAP_INVALID_HANDLE; } GAP_TRACE_EVENT ("GAP_GetRxQueueCnt - rc = 0x%04x, rx_queue_count=%d", diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c b/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c index 6236f12a946..89d74b998fb 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c @@ -33,7 +33,6 @@ #include "l2c_int.h" #include "btm_int.h" #include "stack/btu.h" -#include "stack/hcimsgs.h" #include "osi/allocator.h" #if (L2CAP_COC_INCLUDED == TRUE) @@ -121,7 +120,6 @@ void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data) *******************************************************************************/ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data) { - tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data; UINT16 local_cid = p_ccb->local_cid; tL2CA_DISCONNECT_IND_CB *disconnect_ind; tL2CA_CONNECT_CFM_CB *connect_cfm; @@ -168,6 +166,7 @@ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data) break; case L2CEVT_LP_CONNECT_CFM_NEG: /* Link failed */ + tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data; /* Disconnect unless ACL collision and upper layer wants to handle it */ if (p_ci->status != HCI_ERR_CONNECTION_EXISTS || !btm_acl_notif_conn_collision(p_ccb->p_lcb->remote_bd_addr)) { diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c b/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c index 4d3c2620131..684825f487f 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c @@ -892,7 +892,7 @@ static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word) /* If anything still waiting for ack, restart the timer if it was stopped */ if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q)) { l2c_fcr_start_timer(p_ccb); - } + } return (TRUE); } @@ -1342,7 +1342,7 @@ static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_wo p_buf->len -= 2; if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) { - L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len); + L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_ccb->max_rx_mtu); packet_ok = FALSE; } else if ((p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL) { L2CAP_TRACE_ERROR ("SAR - no buffer for SDU start user_rx_buf_size:%d", p_ccb->ertm_info.user_rx_buf_size); @@ -1451,7 +1451,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq) if (tx_seq == buf_seq) { break; - } + } } } @@ -1466,24 +1466,24 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq) // the transmit data queue that satisfy the layer and event conditions. for (const list_node_t *node = list_begin(p_ccb->p_lcb->link_xmit_data_q); node != list_end(p_ccb->p_lcb->link_xmit_data_q);) { - BT_HDR *p_buf = (BT_HDR *)list_node(node); + BT_HDR *p_node_buf = (BT_HDR *)list_node(node); node = list_next(node); /* Do not flush other CIDs or partial segments */ - if ((p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid)) { - list_remove(p_ccb->p_lcb->link_xmit_data_q, p_buf); - osi_free(p_buf); + if ((p_node_buf->layer_specific == 0) && (p_node_buf->event == p_ccb->local_cid)) { + list_remove(p_ccb->p_lcb->link_xmit_data_q, p_node_buf); + osi_free(p_node_buf); } } /* Also flush our retransmission queue */ while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q)) { osi_free(fixed_queue_dequeue(p_ccb->fcrb.retrans_q, 0)); - } + } if (list_ack != NULL) { node_ack = list_begin(list_ack); - } + } } if (list_ack != NULL) { @@ -1502,7 +1502,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq) if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) ) { break; - } + } } } @@ -2150,11 +2150,11 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked) if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index]) { p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q); - } + } if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index]) { p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q); - } + } /* update sum, max and min of round trip delay of acking */ list_t *list = NULL; @@ -2186,7 +2186,7 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked) if ( delay < p_ccb->fcrb.ack_delay_min[index] ) { p_ccb->fcrb.ack_delay_min[index] = delay; } - } + } } } diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c b/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c index e011ee59718..d3a108bdc44 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c @@ -90,6 +90,12 @@ static void l2c_ucd_data_ind_cback (BD_ADDR rem_bda, BT_HDR *p_buf) L2CAP_TRACE_DEBUG ("L2CAP - l2c_ucd_data_ind_cback"); + if (p_buf->len < L2CAP_UCD_OVERHEAD) { + L2CAP_TRACE_ERROR ("L2CAP - data not enough for l2c_ucd_data_ind_cback %d", p_buf->len); + osi_free (p_buf); + return; + } + p = (UINT8 *)(p_buf + 1) + p_buf->offset; STREAM_TO_UINT16(psm, p) @@ -257,7 +263,6 @@ BOOLEAN L2CA_UcdDeregister_In_CCB_List (void *p_ccb_node, void * context) BOOLEAN L2CA_UcdDeregister ( UINT16 psm ) { - tL2C_CCB *p_ccb; tL2C_RCB *p_rcb; UINT16 xx; diff --git a/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c b/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c index 6528b38ec9f..3e8ae9c51f9 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c @@ -368,11 +368,18 @@ static void read_ready_cb(uint16_t local_channel_id, BT_HDR *packet) l2cap_client_t *client = find(local_channel_id); if (!client) { L2CAP_TRACE_ERROR("%s unable to find L2CAP client matching LCID 0x%04x.\n", __func__, local_channel_id); + osi_free(packet); return; } // TODO(sharvil): eliminate copy from BT_HDR. buffer_t *buffer = buffer_new(packet->len); + if (!buffer) { + L2CAP_TRACE_ERROR("%s unable to new a buffer\n", __func__); + osi_free(packet); + return; + } + memcpy(buffer_ptr(buffer), packet->data + packet->offset, packet->len); osi_free(packet); diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_api.c b/components/bt/host/bluedroid/stack/sdp/sdp_api.c index 1321c4108a3..30d08367388 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_api.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_api.c @@ -72,8 +72,8 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui /* verify the parameters */ if (p_db == NULL || (sizeof (tSDP_DISCOVERY_DB) > len) || num_attr > SDP_MAX_ATTR_FILTERS || num_uuid > SDP_MAX_UUID_FILTERS) { - SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db 0x%x, len %d, num_uuid %d, num_attr %d", - (UINT32)p_db, len, num_uuid, num_attr); + SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db %p, len %d, num_uuid %d, num_attr %d", + p_db, len, num_uuid, num_attr); return (FALSE); } @@ -99,8 +99,9 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui sdpu_sort_attr_list( num_attr, p_db ); p_db->num_attr_filters = num_attr; -#endif return (TRUE); +#endif + return (FALSE); } @@ -124,8 +125,9 @@ BOOLEAN SDP_CancelServiceSearch (tSDP_DISCOVERY_DB *p_db) sdp_disconnect (p_ccb, SDP_CANCEL); p_ccb->disc_state = SDP_DISC_WAIT_CANCEL; -#endif return (TRUE); +#endif + return (FALSE); } @@ -429,7 +431,7 @@ BOOLEAN SDP_FindServiceUUIDInRec_128bit(tSDP_DISC_REC *p_rec, tBT_UUID *p_uuid) for (p_sattr = p_attr->attr_value.v.p_sub_attr; p_sattr; p_sattr = p_sattr->p_next_attr) { if (SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UUID_DESC_TYPE) { /* only support 128 bits UUID for now */ - if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 16) { + if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == LEN_UUID_128) { p_uuid->len = LEN_UUID_128; for (uint8_t i = 0; i != LEN_UUID_128; ++i) { p_uuid->uu.uuid128[i] = p_sattr->attr_value.v.array[LEN_UUID_128 - i - 1]; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_db.c b/components/bt/host/bluedroid/stack/sdp/sdp_db.c index 827134d3cf6..88d84071d0b 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_db.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_db.c @@ -68,15 +68,15 @@ tSDP_RECORD *sdp_db_service_search (tSDP_RECORD *p_rec, tSDP_UUID_SEQ *p_seq) /* If NULL, start at the beginning, else start at the first specified record */ if (!p_rec) { - p_node = list_begin(sdp_cb.server_db.p_record_list); + p_node = list_begin(sdp_cb.server_db.p_record_list); } else { - /* get node in the record list with given p_rec */ + /* get node in the record list with given p_rec */ p_node = list_get_node(sdp_cb.server_db.p_record_list, p_rec); - if (p_node == NULL) { - return NULL; - } - /* get next node */ - p_node = list_next(p_node); + if (p_node == NULL) { + return NULL; + } + /* get next node */ + p_node = list_next(p_node); } /* Look through the records. The spec says that a match occurs if */ @@ -178,8 +178,8 @@ tSDP_RECORD *sdp_db_find_record (UINT32 handle) /* Look through the records for the caller's handle */ for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - p_rec = list_node(p_node); - if (p_rec->record_handle == handle) { + p_rec = list_node(p_node); + if (p_rec->record_handle == handle) { return (p_rec); } } @@ -446,7 +446,7 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type, /* Find the record in the database */ for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - p_rec= list_node(p_node); + p_rec= list_node(p_node); if (p_rec->record_handle == handle) { tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0]; @@ -498,13 +498,12 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type, } } - if ((attr_len > 0) && (p_val != 0)) { + if (attr_len > 0) { p_attr->len = attr_len; memcpy (&p_rec->attr_pad[p_rec->free_pad_ptr], p_val, (size_t)attr_len); p_attr->value_ptr = &p_rec->attr_pad[p_rec->free_pad_ptr]; p_rec->free_pad_ptr += attr_len; - } else if ((attr_len == 0 && p_attr->len != 0) || /* if truncate to 0 length, simply don't add */ - p_val == 0) { + } else if (attr_len == 0 && p_attr->len != 0) { /* if truncate to 0 length, simply don't add */ SDP_TRACE_ERROR("SDP_AddAttribute fail, length exceed maximum: ID %d: attr_len:%d \n", attr_id, attr_len ); p_attr->id = p_attr->type = p_attr->len = 0; @@ -889,7 +888,7 @@ BOOLEAN SDP_DeleteAttribute (UINT32 handle, UINT16 attr_id) /* Find the record in the database */ for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - p_rec= list_node(p_node); + p_rec= list_node(p_node); if (p_rec->record_handle == handle) { tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0]; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c b/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c index d2ac7ccb073..dc311d8a635 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c @@ -90,7 +90,7 @@ static UINT8 *sdpu_build_uuid_seq (UINT8 *p_out, UINT16 num_uuids, tSDP_UUID *p_ UINT32_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid32); } else { UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES); - ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, p_uuid_list->len); + ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, LEN_UUID_128); } } @@ -374,6 +374,10 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset) p = &p_ccb->rsp_list[0]; p_end = &p_ccb->rsp_list[0] + list_len; + if (cpy_len == 0) { + return; + } + if (offset) { type = *p++; cpy_len--; @@ -835,7 +839,7 @@ static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end) ** Returns pointer to next byte in data stream ** *******************************************************************************/ -tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda) +static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda) { tSDP_DISC_REC *p_rec; @@ -950,7 +954,7 @@ static UINT8 *add_attr (UINT8 *p, UINT8 *p_end, tSDP_DISCOVERY_DB *p_db, tSDP_DI break; } } - /* Case falls through */ + /* falls through */ case TWO_COMP_INT_DESC_TYPE: switch (attr_len) { diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_main.c b/components/bt/host/bluedroid/stack/sdp/sdp_main.c index e945314b830..11309caec38 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_main.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_main.c @@ -28,7 +28,6 @@ #include "common/bt_target.h" #include "osi/allocator.h" -#include "stack/l2cdefs.h" #include "stack/hcidefs.h" #include "stack/hcimsgs.h" @@ -138,6 +137,10 @@ void sdp_init (void) { #if SDP_DYNAMIC_MEMORY sdp_cb_ptr = (tSDP_CB *)osi_malloc(sizeof(tSDP_CB)); + if (!sdp_cb_ptr) { + ESP_LOGE("BT_SDP", "SDP control block malloc failed\n"); + return; + } #endif /* #if SDP_DYNAMIC_MEMORY */ /* Clears all structures and local SDP database (if Server is enabled) */ memset (&sdp_cb, 0, sizeof (tSDP_CB)); @@ -208,8 +211,10 @@ void sdp_deinit (void) { list_free(sdp_cb.server_db.p_record_list); #if SDP_DYNAMIC_MEMORY - osi_free(sdp_cb_ptr); - sdp_cb_ptr = NULL; + if (sdp_cb_ptr) { + osi_free(sdp_cb_ptr); + sdp_cb_ptr = NULL; + } #endif /* #if SDP_DYNAMIC_MEMORY */ } @@ -403,7 +408,7 @@ static void sdp_config_ind (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg) p_cfg->mtu_present = FALSE; p_cfg->result = L2CAP_CFG_OK; - /* Check peer config request against our rfcomm configuration */ + /* Check peer config request against our sdp configuration */ if (p_cfg->fcr_present) { /* Reject the window size if it is bigger than we want it to be */ if (p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE) { diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_server.c b/components/bt/host/bluedroid/stack/sdp/sdp_server.c index 9d3d81c184e..645e175ea5f 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_server.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_server.c @@ -344,13 +344,18 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN; } - p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq); + p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq); if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST); return; } + if (max_list_len < 4) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL); + return; + } + memcpy(&attr_seq_sav, &attr_seq, sizeof(tSDP_ATTR_SEQ)) ; /* Find a record with the record handle */ @@ -375,31 +380,32 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, p_ccb->rsp_list = (UINT8 *)osi_malloc(max_list_len); if (p_ccb->rsp_list == NULL) { SDP_TRACE_ERROR("%s No scratch buf for attr rsp\n", __func__); + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); return; } if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } BE_STREAM_TO_UINT16 (cont_offset, p_req); if (cont_offset != p_ccb->cont_offset) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } - if (!p_ccb->rsp_list) { - sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); - return; - } is_cont = TRUE; /* Initialise for continuation response */ p_rsp = &p_ccb->rsp_list[0]; attr_seq.attr_entry[p_ccb->cont_info.next_attr_index].start = p_ccb->cont_info.next_attr_start_id; } else { - if (p_ccb->rsp_list) { + if (p_ccb->rsp_list) { osi_free (p_ccb->rsp_list); } @@ -438,6 +444,12 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (p_ccb->cont_info.attr_offset) { p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } /* If the partial attrib could not been fully added yet */ if (p_ccb->cont_info.attr_offset != attr_len) { @@ -449,12 +461,20 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (attr_len >= SDP_MAX_ATTR_LEN) { SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len); sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } /* add the partial attribute if possible */ p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } p_ccb->cont_info.next_attr_index = xx; p_ccb->cont_info.next_attr_start_id = p_attr->id; @@ -502,6 +522,8 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* Get a buffer to use to build the response */ if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } p_buf->offset = L2CAP_MIN_OFFSET; @@ -574,7 +596,6 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, BOOLEAN maxxed_out = FALSE, is_cont = FALSE; UINT8 *p_seq_start; UINT16 seq_len, attr_len; - UNUSED(p_req_end); /* Extract the UUID sequence to search for */ p_req = sdpu_extract_uid_seq (p_req, param_len, &uid_seq); @@ -591,9 +612,9 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, max_list_len = p_ccb->rem_mtu_size - SDP_MAX_SERVATTR_RSPHDR_LEN; } - p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq); + p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq); - if ((!p_req) || (!attr_seq.num_attr)) { + if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST); return; } @@ -625,17 +646,23 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } BE_STREAM_TO_UINT16 (cont_offset, p_req); if (cont_offset != p_ccb->cont_offset) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } if (!p_ccb->rsp_list) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } is_cont = TRUE; @@ -704,6 +731,12 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (p_ccb->cont_info.attr_offset) { p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } /* If the partial attrib could not been fully added yet */ if (p_ccb->cont_info.attr_offset != attr_len) { @@ -716,12 +749,20 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (attr_len >= SDP_MAX_ATTR_LEN) { SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len); sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } /* add the partial attribute if possible */ p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } p_ccb->cont_info.next_attr_index = xx; p_ccb->cont_info.next_attr_start_id = p_attr->id; @@ -791,6 +832,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, // TODO(sharvil): rewrite SDP server. if (is_cont && len_to_send == 0) { sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } @@ -817,6 +860,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* Get a buffer to use to build the response */ if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } p_buf->offset = L2CAP_MIN_OFFSET; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_utils.c b/components/bt/host/bluedroid/stack/sdp/sdp_utils.c index f354ea3ad35..4ded1162707 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_utils.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_utils.c @@ -361,6 +361,8 @@ void sdpu_build_n_send_error (tCONN_CB *p_ccb, UINT16 trans_num, UINT16 error_co UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) { UINT8 *p_seq_end; + UINT8 *p_param_start; + UINT8 *p_param_end; UINT8 descr, type, size; UINT32 seq_len, uuid_len; @@ -368,7 +370,12 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) p_seq->num_uids = 0; /* A UID sequence is composed of a bunch of UIDs. */ + p_param_start = p; + p_param_end = p_param_start + param_len; + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -388,26 +395,38 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) seq_len = 16; break; case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (seq_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT16 (seq_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT32 (seq_len, p); break; default: return (NULL); } - if (seq_len >= param_len) { + p_seq_end = p + seq_len; + if (p_seq_end < p || p_seq_end > p_param_end) { return (NULL); } - p_seq_end = p + seq_len; - /* Loop through, extracting the UIDs */ for ( ; p < p_seq_end ; ) { + if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) { + return (NULL); + } + BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -427,31 +446,37 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) uuid_len = 16; break; case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_seq_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (uuid_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_seq_end) { + return (NULL); + } BE_STREAM_TO_UINT16 (uuid_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_seq_end) { + return (NULL); + } BE_STREAM_TO_UINT32 (uuid_len, p); break; default: return (NULL); } - /* If UUID length is valid, copy it across */ - if ((uuid_len == 2) || (uuid_len == 4) || (uuid_len == 16)) { - p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len; - BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len); - p_seq->num_uids++; - } else { + if ((uuid_len != 2) && (uuid_len != 4) && (uuid_len != 16)) { + return (NULL); + } + if (p + uuid_len > p_seq_end) { return (NULL); } - /* We can only do so many */ - if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) { - return (NULL); - } + p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len; + BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len); + p_seq->num_uids++; } if (p != p_seq_end) { @@ -476,13 +501,22 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) { UINT8 *p_end_list; + UINT8 *p_param_start; + UINT8 *p_param_end; UINT8 descr, type, size; UINT32 list_len, attr_len; /* Assume none found */ p_seq->num_attr = 0; + /* param_len is bytes available from p through end of SDP parameter block */ + p_param_start = p; + p_param_end = p_param_start + param_len; + /* Get attribute sequence info */ + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -493,14 +527,23 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) switch (size) { case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (list_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT16 (list_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT32 (list_len, p); break; @@ -508,14 +551,17 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) return (p); } - if (list_len > param_len) { - return (p); - } - p_end_list = p + list_len; + if (p_end_list < p || p_end_list > p_param_end) { + return (NULL); + } /* Loop through, extracting the attribute IDs */ for ( ; p < p_end_list ; ) { + if (p_seq->num_attr >= MAX_ATTR_PER_SEQ) { + return (NULL); + } + BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -532,34 +578,45 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) attr_len = 4; break; case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT8 (attr_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT16 (attr_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT32 (attr_len, p); break; default: return (NULL); - break; } /* Attribute length must be 2-bytes or 4-bytes for a paired entry. */ if (attr_len == 2) { + if (p + 2 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p); p_seq->attr_entry[p_seq->num_attr].end = p_seq->attr_entry[p_seq->num_attr].start; } else if (attr_len == 4) { + if (p + 4 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p); BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].end, p); } else { return (NULL); } - /* We can only do so many */ - if (++p_seq->num_attr >= MAX_ATTR_PER_SEQ) { - return (NULL); - } + p_seq->num_attr++; } return (p); @@ -995,6 +1052,25 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI UINT8 *p_tmp_attr; size_t len_to_copy; UINT16 attr_len; + UINT16 rem_in_attr; + + attr_len = sdpu_get_attrib_entry_len(p_attr); + if (attr_len > SDP_MAX_ATTR_LEN) { + SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: attr_len %u exceeds SDP_MAX_ATTR_LEN %u\n", + attr_len, (UINT16)SDP_MAX_ATTR_LEN); + return NULL; + } + if (*offset > attr_len) { + SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: offset %u past attr_len %u\n", *offset, attr_len); + return NULL; + } + + rem_in_attr = (UINT16)(attr_len - *offset); + len_to_copy = (size_t)((rem_in_attr < len) ? rem_in_attr : len); + /* rem_in_attr is 0 when *offset == attr_len; avoid memcpy(0) issues and useless work */ + if (len_to_copy == 0) { + return p_out; + } if ((p_attr_buff = (UINT8 *) osi_malloc(sizeof(UINT8) * SDP_MAX_ATTR_LEN )) == NULL) { SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry cannot get a buffer!\n"); @@ -1003,14 +1079,11 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI p_tmp_attr = p_attr_buff; sdpu_build_attrib_entry(p_tmp_attr, p_attr); - attr_len = sdpu_get_attrib_entry_len(p_attr); - - len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset) : len; memcpy(p_out, &p_attr_buff[*offset], len_to_copy); p_out = &p_out[len_to_copy]; - *offset += len_to_copy; + *offset += (UINT16)len_to_copy; osi_free(p_attr_buff); return p_out; diff --git a/components/bt/host/bluedroid/stack/smp/smp_br_main.c b/components/bt/host/bluedroid/stack/smp/smp_br_main.c index 5ef7a7c694e..cf477897348 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_br_main.c +++ b/components/bt/host/bluedroid/stack/smp/smp_br_main.c @@ -37,7 +37,7 @@ const char *const smp_br_event_name [SMP_BR_MAX_EVT] = { "BR_CONFIRM_EVT", "BR_RAND_EVT", "BR_PAIRING_FAILED_EVT", - "BR_ENCRPTION_INFO_EVT", + "BR_ENCRYPTION_INFO_EVT", "BR_MASTER_ID_EVT", "BR_ID_INFO_EVT", "BR_ID_ADDR_EVT", @@ -316,7 +316,13 @@ void smp_br_state_machine_event(tSMP_CB *p_cb, tSMP_BR_EVENT event, void *p_data tSMP_BR_STATE curr_state = p_cb->br_state; tSMP_BR_SM_TBL state_table; UINT8 action, entry; - tSMP_BR_ENTRY_TBL entry_table = smp_br_entry_table[p_cb->role]; + tSMP_BR_ENTRY_TBL entry_table = NULL; + + if (p_cb->role > HCI_ROLE_SLAVE) { + SMP_TRACE_ERROR("Invalid role: %d", p_cb->role); + return; + } + entry_table = smp_br_entry_table[p_cb->role]; SMP_TRACE_EVENT("main %s", __func__); if (curr_state >= SMP_BR_STATE_MAX) {