Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): optimize bluedroid some code

Browse Source 
(cherry picked from commit 6b09de6dbf)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
This commit is contained in:
Zhi Wei Jian
2026-01-05 10:07:26 +08:00
parent 78d2325639
commit d57e7a22f9
9 changed files with 197 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c
+1
View File
@@ -17,6 +17,7 @@ tBTM_BLE_EXTENDED_CB extend_adv_cb;
tBTM_BLE_5_HCI_CBACK ble_5_hci_cb;
#define INVALID_VALUE 0XFF
extern BOOLEAN BTM_GetLocalResolvablePrivateAddr(BD_ADDR bda);
extern void BTM_UpdateAddrInfor(uint8_t addr_type, BD_ADDR bda);
extern void BTM_BleSetStaticAddr(BD_ADDR rand_addr);
components/bt/host/bluedroid/stack/btm/btm_ble_cte.c
-2
View File
@@ -38,8 +38,6 @@ void BTM_CteBleCallbackTrigger(tBTM_BLE_5_GAP_EVENT event, tBTM_BLE_CTE_CB_PARAM
#if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE)
tBTM_STATUS BTM_BleSetCteTransParams(uint8_t adv_handle, uint8_t cte_len, uint8_t cte_type, uint8_t cte_count, uint8_t switching_pattern_len, uint8_t *antenna_ids)
{
tHCI_STATUS err = HCI_SUCCESS;
tBTM_STATUS status = BTM_SUCCESS;
tBTM_BLE_CTE_CB_PARAMS cb_params = {0};
components/bt/host/bluedroid/stack/btm/btm_ble_iso.c
+79 -10
View File
@@ -85,11 +85,20 @@ void btm_ble_iso_read_iso_link_quality_complete(UINT8 *p)
void btm_ble_iso_set_cig_params_complete(UINT8 *p)
{
tBTM_BLE_ISO_CB_PARAMS cb_params = {0};
UINT8 cis_count;
STREAM_TO_UINT8(cb_params.btm_set_cig_params.status, p);
STREAM_TO_UINT8(cb_params.btm_set_cig_params.cig_id, p);
STREAM_TO_UINT8(cb_params.btm_set_cig_params.cis_count, p);
for (uint8_t i = 0; i < cb_params.btm_set_cig_params.cis_count; i++)
STREAM_TO_UINT8(cis_count, p);
// Validate cis_count to prevent buffer overflow
if (cis_count > BLE_ISO_CIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, cis_count %d exceeds BLE_ISO_CIS_MAX_COUNT %d", __func__, cis_count, BLE_ISO_CIS_MAX_COUNT);
cis_count = BLE_ISO_CIS_MAX_COUNT;
}
cb_params.btm_set_cig_params.cis_count = cis_count;
for (uint8_t i = 0; i < cis_count; i++)
{
STREAM_TO_UINT16(cb_params.btm_set_cig_params.conn_hdl[i], p);
BTM_TRACE_DEBUG("i = %d, conn_hdl = %d", i, cb_params.btm_set_cig_params.conn_hdl[i]);
@@ -158,6 +167,8 @@ void btm_ble_big_create_cmpl_evt(tBTM_BLE_BIG_CREATE_CMPL *params)
{
BTM_TRACE_DEBUG("%s", __func__);
tBTM_BLE_ISO_CB_PARAMS cb_params = {0};
UINT8 num_bis;
if (!params) {
BTM_TRACE_ERROR("%s, Invalid params.", __func__);
return;
@@ -167,6 +178,13 @@ void btm_ble_big_create_cmpl_evt(tBTM_BLE_BIG_CREATE_CMPL *params)
params->status = (params->status | BTM_HCI_ERROR);
}
// Validate num_bis to prevent buffer overflow
num_bis = params->num_bis;
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
num_bis = BLE_ISO_BIS_MAX_COUNT;
}
cb_params.btm_big_cmpl.status = params->status;
cb_params.btm_big_cmpl.big_handle = params->big_handle;
cb_params.btm_big_cmpl.big_sync_delay = params->big_sync_delay;
@@ -178,14 +196,12 @@ void btm_ble_big_create_cmpl_evt(tBTM_BLE_BIG_CREATE_CMPL *params)
cb_params.btm_big_cmpl.irc = params->irc;
cb_params.btm_big_cmpl.max_pdu = params->max_pdu;
cb_params.btm_big_cmpl.iso_interval = params->iso_interval;
cb_params.btm_big_cmpl.num_bis = params->num_bis;
// for (uint8_t i = 0; i < params->num_bis; i++)
// {
// cb_params.btm_big_cmpl.bis_handle[i] = params->bis_handle[i];
// }
memcpy(&cb_params.btm_big_cmpl.bis_handle[0], &params->bis_handle[0], params->num_bis * 2);
cb_params.btm_big_cmpl.num_bis = num_bis;
//memcpy(&cb_params.btm_big_cmpl, params, sizeof(tBTM_BLE_BIG_CREATE_CMPL));
// Copy bis_handle array with bounds checking
if (num_bis > 0) {
memcpy(&cb_params.btm_big_cmpl.bis_handle[0], &params->bis_handle[0], num_bis * sizeof(UINT16));
}
BTM_IsoBleCallbackTrigger(BTM_BLE_ISO_BIG_CREATE_COMPLETE_EVT, &cb_params);
}
@@ -207,6 +223,8 @@ void btm_ble_big_terminate_cmpl_evt(tBTM_BLE_BIG_TERMINATE_CMPL *params)
void btm_ble_big_sync_estab_evt(tBTM_BLE_BIG_SYNC_ESTAB_CMPL *params)
{
tBTM_BLE_ISO_CB_PARAMS cb_params = {0};
UINT8 num_bis;
if (!params) {
BTM_TRACE_ERROR("%s, Invalid params.", __func__);
return;
@@ -216,7 +234,28 @@ void btm_ble_big_sync_estab_evt(tBTM_BLE_BIG_SYNC_ESTAB_CMPL *params)
params->status = (params->status | BTM_HCI_ERROR);
}
memcpy(&cb_params.btm_big_sync_estab, params, sizeof(tBTM_BLE_BIG_SYNC_ESTAB_CMPL));
// Validate num_bis to prevent buffer overflow
num_bis = params->num_bis;
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
num_bis = BLE_ISO_BIS_MAX_COUNT;
}
cb_params.btm_big_sync_estab.status = params->status;
cb_params.btm_big_sync_estab.big_handle = params->big_handle;
cb_params.btm_big_sync_estab.transport_latency_big = params->transport_latency_big;
cb_params.btm_big_sync_estab.nse = params->nse;
cb_params.btm_big_sync_estab.bn = params->bn;
cb_params.btm_big_sync_estab.pto = params->pto;
cb_params.btm_big_sync_estab.irc = params->irc;
cb_params.btm_big_sync_estab.max_pdu = params->max_pdu;
cb_params.btm_big_sync_estab.iso_interval = params->iso_interval;
cb_params.btm_big_sync_estab.num_bis = num_bis;
// Copy bis_handle array with bounds checking
if (num_bis > 0) {
memcpy(&cb_params.btm_big_sync_estab.bis_handle[0], &params->bis_handle[0], num_bis * sizeof(uint16_t));
}
BTM_IsoBleCallbackTrigger(BTM_BLE_ISO_BIG_SYNC_ESTABLISHED_EVT, &cb_params);
}
@@ -286,6 +325,11 @@ tBTM_STATUS BTM_BleBigCreate(uint8_t big_handle, uint8_t adv_handle, uint8_t num
rtn %d phy %d packing %d framing %d encryption %d broadcast_code %d", big_handle, adv_handle, num_bis, sdu_interval, max_sdu, max_transport_latency,\
rtn, phy, packing, framing, encryption, broadcast_code);
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
return BTM_ILLEGAL_VALUE;
}
btsnd_hcic_ble_big_create(big_handle, adv_handle, num_bis, sdu_interval, max_sdu, max_transport_latency,
rtn, phy, packing, framing, encryption, broadcast_code);
@@ -299,6 +343,11 @@ tBTM_STATUS BTM_BleBigCreateTest(uint8_t big_handle, uint8_t adv_handle, uint8_t
uint8_t packing, uint8_t framing, uint8_t bn, uint8_t irc,
uint8_t pto, uint8_t encryption, uint8_t *broadcast_code)
{
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
return BTM_ILLEGAL_VALUE;
}
btsnd_hcic_ble_big_create_test(big_handle, adv_handle, num_bis, sdu_interval, iso_interval, nse,
max_sdu, max_pdu, phy, packing, framing, bn, irc, pto, encryption,
broadcast_code);
@@ -331,6 +380,11 @@ tBTM_STATUS BTM_BleBigSyncCreate(uint8_t big_handle, uint16_t sync_handle,
uint8_t mse, uint16_t big_sync_timeout,
uint8_t num_bis, uint8_t *bis)
{
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
return BTM_ILLEGAL_VALUE;
}
btsnd_hcic_ble_big_sync_create(big_handle, sync_handle, encryption, bc_code,
mse, big_sync_timeout, num_bis, bis);
return BTM_SUCCESS;
@@ -430,6 +484,11 @@ tBTM_STATUS BTM_BleSetCigParams(uint8_t cig_id, uint32_t sdu_int_c_to_p, uint32_
tHCI_STATUS err = HCI_SUCCESS;
tBTM_STATUS status = BTM_SUCCESS;
if (cis_cnt > BLE_ISO_CIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, cis_cnt %d exceeds BLE_ISO_CIS_MAX_COUNT %d", __func__, cis_cnt, BLE_ISO_CIS_MAX_COUNT);
return BTM_ILLEGAL_VALUE;
}
if ((err = btsnd_hcic_ble_iso_set_cig_params(cig_id, sdu_int_c_to_p, sdu_int_p_to_c, worse_case_SCA, packing,
framing, mtl_c_to_p, mtl_p_to_c, cis_cnt, (struct ble_hci_le_cis_params *)cis_params)) != HCI_SUCCESS) {
BTM_TRACE_ERROR("iso set cig params, cmd err=0x%x", err);
@@ -445,6 +504,11 @@ tBTM_STATUS BTM_BleSetCigParamsTest(uint8_t cig_id, uint32_t sdu_int_c_to_p, uin
tHCI_STATUS err = HCI_SUCCESS;
tBTM_STATUS status = BTM_SUCCESS;
if (cis_cnt > BLE_ISO_CIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, cis_cnt %d exceeds BLE_ISO_CIS_MAX_COUNT %d", __func__, cis_cnt, BLE_ISO_CIS_MAX_COUNT);
return BTM_ILLEGAL_VALUE;
}
if ((err = btsnd_hcic_ble_iso_set_cig_params_test(cig_id, sdu_int_c_to_p, sdu_int_p_to_c,ft_c_to_p, ft_p_to_c, iso_interval,
worse_case_SCA, packing, framing, cis_cnt, (struct ble_hci_le_cis_params_test *)cis_params)) != HCI_SUCCESS) {
BTM_TRACE_ERROR("iso set cig params test, cmd err=0x%x", err);
@@ -461,6 +525,11 @@ void btm_ble_create_cis_cmd_status(tBTM_BLE_ISO_CB_PARAMS *cb_params)
tBTM_STATUS BTM_BleCreateCis(uint8_t cis_count, uint8_t *cis_hdls)
{
if (cis_count > BLE_ISO_CIS_MAX_COUNT) {
BTM_TRACE_ERROR("%s, cis_count %d exceeds BLE_ISO_CIS_MAX_COUNT %d", __func__, cis_count, BLE_ISO_CIS_MAX_COUNT);
return BTM_ILLEGAL_VALUE;
}
btsnd_hcic_ble_iso_create_cis(cis_count, (struct ble_hci_cis_hdls *)cis_hdls);
return BTM_SUCCESS;
components/bt/host/bluedroid/stack/btu/btu_hcif.c
+82 -14
View File
@@ -52,6 +52,17 @@
extern void btm_process_cancel_complete(UINT8 status, UINT8 mode);
extern void btm_ble_test_command_complete(UINT8 *p);
#if (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE)
// BLE Channel Sounding parameter validation macros per BLE spec
#define BTM_BLE_CS_MAX_STEPS_REPORTED 0xA0 // Range: 0x00 to 0xA0 (0 to 160)
#endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE)
#if (BLE_FEAT_CTE_EN == TRUE)
// BLE CTE parameter validation macros per BLE spec
#define BTM_BLE_CTE_MAX_SAMPLE_COUNT 0x52 // Maximum sample count per BLE spec: 0x52 (82)
#endif // (BLE_FEAT_CTE_EN == TRUE)
/********************************************************************************/
/* L O C A L F U N C T I O N P R O T O T Y P E S */
/********************************************************************************/
@@ -2909,6 +2920,7 @@ static void btu_ble_big_create_complete_evt(UINT8 *p)
{
HCI_TRACE_DEBUG("%s", __func__);
tBTM_BLE_BIG_CREATE_CMPL big_cmpl = {0};
UINT8 num_bis;
if (!p) {
HCI_TRACE_ERROR("%s, Invalid params.", __func__);
@@ -2926,8 +2938,16 @@ static void btu_ble_big_create_complete_evt(UINT8 *p)
STREAM_TO_UINT8(big_cmpl.irc, p);
STREAM_TO_UINT16(big_cmpl.max_pdu, p);
STREAM_TO_UINT16(big_cmpl.iso_interval, p);
STREAM_TO_UINT8(big_cmpl.num_bis, p);
for (uint8_t i = 0; i < big_cmpl.num_bis; i++)
STREAM_TO_UINT8(num_bis, p);
// Validate num_bis to prevent buffer overflow
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
HCI_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
num_bis = BLE_ISO_BIS_MAX_COUNT;
}
big_cmpl.num_bis = num_bis;
for (uint8_t i = 0; i < num_bis; i++)
{
STREAM_TO_UINT16(big_cmpl.bis_handle[i], p);
// only 12 bits meaningful
@@ -2976,6 +2996,7 @@ void btu_ble_create_big_sync_cmd_status(UINT8 status)
static void btu_ble_big_sync_establish_evt(UINT8 *p)
{
tBTM_BLE_BIG_SYNC_ESTAB_CMPL big_estb = {0};
UINT8 num_bis;
if (!p) {
HCI_TRACE_ERROR("%s, Invalid params.", __func__);
@@ -2991,8 +3012,16 @@ static void btu_ble_big_sync_establish_evt(UINT8 *p)
STREAM_TO_UINT8(big_estb.irc, p);
STREAM_TO_UINT16(big_estb.max_pdu, p);
STREAM_TO_UINT16(big_estb.iso_interval, p);
STREAM_TO_UINT8(big_estb.num_bis, p);
for (uint8_t i = 0; i < big_estb.num_bis; i++)
STREAM_TO_UINT8(num_bis, p);
// Validate num_bis to prevent buffer overflow
if (num_bis > BLE_ISO_BIS_MAX_COUNT) {
HCI_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT);
num_bis = BLE_ISO_BIS_MAX_COUNT;
}
big_estb.num_bis = num_bis;
for (uint8_t i = 0; i < num_bis; i++)
{
STREAM_TO_UINT16(big_estb.bis_handle[i], p);
}
@@ -3048,6 +3077,7 @@ static void btu_ble_biginfo_adv_report_evt(UINT8 *p)
static void btu_ble_cte_connless_iq_report_evt(UINT8 *p)
{
tBTM_BLE_CTE_CONNLESS_IQ_REPORT_EVT connless_iq_rpt = {0};
UINT8 sample_count;
if (!p) {
HCI_TRACE_ERROR("%s, Invalid params.", __func__);
@@ -3062,14 +3092,21 @@ static void btu_ble_cte_connless_iq_report_evt(UINT8 *p)
STREAM_TO_UINT8(connless_iq_rpt.slot_dur, p);
STREAM_TO_UINT8(connless_iq_rpt.pkt_status, p);
STREAM_TO_UINT16(connless_iq_rpt.periodic_evt_counter, p);
STREAM_TO_UINT8(connless_iq_rpt.sample_count, p);
STREAM_TO_UINT8(sample_count, p);
for (uint8_t i = 0; i < connless_iq_rpt.sample_count; i++)
// Validate sample_count to prevent buffer overflow
if (sample_count > BTM_BLE_CTE_MAX_SAMPLE_COUNT) {
HCI_TRACE_ERROR("%s, sample_count %d exceeds maximum %d", __func__, sample_count, BTM_BLE_CTE_MAX_SAMPLE_COUNT);
sample_count = BTM_BLE_CTE_MAX_SAMPLE_COUNT;
}
connless_iq_rpt.sample_count = sample_count;
for (uint8_t i = 0; i < sample_count; i++)
{
STREAM_TO_UINT8(connless_iq_rpt.i_sample[i], p);
}
for (uint8_t i = 0; i < connless_iq_rpt.sample_count; i++)
for (uint8_t i = 0; i < sample_count; i++)
{
STREAM_TO_UINT8(connless_iq_rpt.q_sample[i], p);
}
@@ -3082,6 +3119,7 @@ static void btu_ble_cte_connless_iq_report_evt(UINT8 *p)
static void btu_ble_cte_conn_iq_report_evt(UINT8 *p)
{
tBTM_BLE_CTE_CONN_IQ_REPORT_EVT conn_iq_rpt = {0};
UINT8 sample_count;
if (!p) {
HCI_TRACE_ERROR("%s, Invalid params.", __func__);
@@ -3097,14 +3135,21 @@ static void btu_ble_cte_conn_iq_report_evt(UINT8 *p)
STREAM_TO_UINT8(conn_iq_rpt.slot_dur, p);
STREAM_TO_UINT8(conn_iq_rpt.pkt_status, p);
STREAM_TO_UINT16(conn_iq_rpt.conn_evt_counter, p);
STREAM_TO_UINT8(conn_iq_rpt.sample_count, p);
STREAM_TO_UINT8(sample_count, p);
for (uint8_t i = 0; i < conn_iq_rpt.sample_count; i++)
// Validate sample_count to prevent buffer overflow
if (sample_count > BTM_BLE_CTE_MAX_SAMPLE_COUNT) {
HCI_TRACE_ERROR("%s, sample_count %d exceeds maximum %d", __func__, sample_count, BTM_BLE_CTE_MAX_SAMPLE_COUNT);
sample_count = BTM_BLE_CTE_MAX_SAMPLE_COUNT;
}
conn_iq_rpt.sample_count = sample_count;
for (uint8_t i = 0; i < sample_count; i++)
{
STREAM_TO_UINT8(conn_iq_rpt.i_sample[i], p);
}
for (uint8_t i = 0; i < conn_iq_rpt.sample_count; i++)
for (uint8_t i = 0; i < sample_count; i++)
{
STREAM_TO_UINT8(conn_iq_rpt.q_sample[i], p);
}
@@ -3215,6 +3260,7 @@ static void btu_ble_pa_response_report_evt(UINT8 *p)
STREAM_TO_UINT8(pa_rsp_rpt_evt.tx_status, p);
STREAM_TO_UINT8(pa_rsp_rpt_evt.num_rsp, p);
// num_rsp is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate
if (pa_rsp_rpt_evt.num_rsp) {
pa_rsp_rpt_evt.rsp_data_info = osi_malloc(pa_rsp_rpt_evt.num_rsp * sizeof(tBTM_BLE_PA_RSP_DATA_INFO));
if (pa_rsp_rpt_evt.rsp_data_info)
@@ -3227,17 +3273,21 @@ static void btu_ble_pa_response_report_evt(UINT8 *p)
STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].rsp_slot, p);
STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].data_status, p);
STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].data_len, p);
// data_len is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate
if (pa_rsp_rpt_evt.rsp_data_info[i].data_len) {
pa_rsp_rpt_evt.rsp_data_info[i].data = osi_malloc(pa_rsp_rpt_evt.rsp_data_info[i].data_len);
if (pa_rsp_rpt_evt.rsp_data_info[i].data) {
STREAM_TO_ARRAY(pa_rsp_rpt_evt.rsp_data_info[i].data, p, pa_rsp_rpt_evt.rsp_data_info[i].data_len);
} else {
HCI_TRACE_ERROR("%s, no enough memory.", __func__);
HCI_TRACE_ERROR("%s, no enough memory for data_len %d at index %d", __func__, pa_rsp_rpt_evt.rsp_data_info[i].data_len, i);
pa_rsp_rpt_evt.rsp_data_info[i].data_len = 0;
}
} else {
pa_rsp_rpt_evt.rsp_data_info[i].data = NULL;
}
}
} else {
HCI_TRACE_ERROR("%s, no memory.", __func__);
HCI_TRACE_ERROR("%s, no memory for rsp_data_info", __func__);
}
}
@@ -3397,7 +3447,15 @@ static void btu_ble_cs_subevt_result_evt(UINT8 *p)
STREAM_TO_UINT8(subevt_result.subevent_done_status, p);
STREAM_TO_UINT8(subevt_result.abort_reason, p);
STREAM_TO_UINT8(subevt_result.num_ant_paths, p);
STREAM_TO_UINT8(subevt_result.num_steps_reported, p);
UINT8 num_steps_reported;
STREAM_TO_UINT8(num_steps_reported, p);
// Validate num_steps_reported per BLE spec: Range 0x00 to 0xA0 (0 to 160)
if (num_steps_reported > BTM_BLE_CS_MAX_STEPS_REPORTED) {
HCI_TRACE_ERROR("%s, num_steps_reported %d exceeds maximum %d", __func__, num_steps_reported, BTM_BLE_CS_MAX_STEPS_REPORTED);
num_steps_reported = BTM_BLE_CS_MAX_STEPS_REPORTED;
}
subevt_result.num_steps_reported = num_steps_reported;
subevt_result.step_info = osi_malloc(subevt_result.num_steps_reported * sizeof(tBTM_BLE_CS_STEP_INFO));
if (subevt_result.step_info) {
@@ -3406,6 +3464,7 @@ static void btu_ble_cs_subevt_result_evt(UINT8 *p)
STREAM_TO_UINT8(subevt_result.step_info[i].step_mode, p);
STREAM_TO_UINT8(subevt_result.step_info[i].step_channel, p);
STREAM_TO_UINT8(subevt_result.step_info[i].step_data_len, p);
// step_data_len is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate
subevt_result.step_info[i].data = osi_malloc(subevt_result.step_info[i].step_data_len);
if (subevt_result.step_info[i].data) {
STREAM_TO_ARRAY(subevt_result.step_info[i].data, p, subevt_result.step_info[i].step_data_len);
@@ -3445,7 +3504,15 @@ static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p)
STREAM_TO_UINT8(subevt_continue_result.subevt_done_status, p);
STREAM_TO_UINT8(subevt_continue_result.abort_reason, p);
STREAM_TO_UINT8(subevt_continue_result.num_ant_paths, p);
STREAM_TO_UINT8(subevt_continue_result.num_steps_reported, p);
UINT8 num_steps_reported;
STREAM_TO_UINT8(num_steps_reported, p);
// Validate num_steps_reported per BLE spec: Range 0x00 to 0xA0 (0 to 160)
if (num_steps_reported > BTM_BLE_CS_MAX_STEPS_REPORTED) {
HCI_TRACE_ERROR("%s, num_steps_reported %d exceeds maximum %d", __func__, num_steps_reported, BTM_BLE_CS_MAX_STEPS_REPORTED);
num_steps_reported = BTM_BLE_CS_MAX_STEPS_REPORTED;
}
subevt_continue_result.num_steps_reported = num_steps_reported;
subevt_continue_result.step_info = osi_malloc(subevt_continue_result.num_steps_reported * sizeof(tBTM_BLE_CS_STEP_INFO));
if (subevt_continue_result.step_info) {
@@ -3453,6 +3520,7 @@ static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p)
STREAM_TO_UINT8(subevt_continue_result.step_info[i].step_mode, p);
STREAM_TO_UINT8(subevt_continue_result.step_info[i].step_channel, p);
STREAM_TO_UINT8(subevt_continue_result.step_info[i].step_data_len, p);
// step_data_len is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate
subevt_continue_result.step_info[i].data = osi_malloc(subevt_continue_result.step_info[i].step_data_len);
if (subevt_continue_result.step_info[i].data) {
STREAM_TO_ARRAY(subevt_continue_result.step_info[i].data, p, subevt_continue_result.step_info[i].step_data_len);