Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): fix direct-connect cleanup and adv bounds

Browse Source 
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
This commit is contained in:
Zhi Wei Jian
2026-07-14 12:04:08 +08:00
parent 1330f558e1
commit e2735b1bb5
3 changed files with 49 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c
View File

@@ -859,6 +859,35 @@ void btm_ble_enqueue_direct_conn_req(void *p_param)
}
/*******************************************************************************
**
** Function btm_ble_remove_direct_conn_req
**
** Description Remove a pending direct connection request for the given LCB.
**
** Returns None.
**
*******************************************************************************/
void btm_ble_remove_direct_conn_req(void *p_param)
{
fixed_queue_t *q = btm_cb.ble_ctr_cb.conn_pending_q;
if (q == NULL || p_param == NULL) {
return;
}
list_t *list = fixed_queue_get_list(q);
for (const list_node_t *node = list_begin(list); node != NULL; node = list_next(node)) {
tBTM_BLE_CONN_REQ *p = (tBTM_BLE_CONN_REQ *)list_node(node);
if (p->p_param == p_param) {
if (fixed_queue_try_remove_from_queue(q, p) != NULL) {
osi_free(p);
}
break;
}
}
}
/*******************************************************************************
**
** Function btm_send_pending_direct_conn
**
** Description This function send the pending direct connection request in queue
@@ -873,7 +902,17 @@ BOOLEAN btm_send_pending_direct_conn(void)
p_req = (tBTM_BLE_CONN_REQ*)fixed_queue_dequeue(btm_cb.ble_ctr_cb.conn_pending_q, 0);
if (p_req != NULL) {
rt = l2cble_init_direct_conn((tL2C_LCB *)(p_req->p_param));
tL2C_LCB *p_lcb = (tL2C_LCB *)(p_req->p_param);
if (p_lcb == NULL || !p_lcb->in_use) {
osi_free((void *)p_req);
return FALSE;
}
rt = l2cble_init_direct_conn(p_lcb);
if (!rt) {
l2cu_release_lcb(p_lcb);
}
osi_free((void *)p_req);
}

9
components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
View File

@@ -1841,7 +1841,7 @@ UINT8 *btm_ble_build_adv_data(tBTM_BLE_AD_MASK *p_data_mask, UINT8 **p_dst,
if (len > MIN_ADV_LENGTH && data_mask & BTM_BLE_AD_BIT_SERVICE_DATA &&
p_data && p_data->p_service_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) {
if (len > (p_data->p_service_data->service_uuid.len + MIN_ADV_LENGTH)) {
if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH)) {
if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len)) {
cp_len = len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len;
} else {
cp_len = p_data->p_service_data->len;
@@ -2895,6 +2895,9 @@ void btm_send_sel_conn_callback(BD_ADDR remote_bda, UINT8 evt_type, UINT8 *p_dat
}
if (p_dev_name) {
if (len > sizeof(remname) - 1) {
len = sizeof(remname) - 1;
}
memcpy(remname, p_dev_name, len);
}
}
@@ -3018,6 +3021,10 @@ void btm_ble_process_adv_pkt (UINT8 *p_data, UINT8 evt_len)
#endif
/* Validate data_len before any path (callee reads 1 + data_len + 1 = data_len+2 bytes from p) */
data_len = *p; /* read without advancing; p points to data_len byte */
if (data_len > BTM_BLE_ADV_DATA_LEN_MAX) {
BTM_TRACE_ERROR("btm_ble_process_adv_pkt: legacy adv data_len %u exceeds max %u", data_len, BTM_BLE_ADV_DATA_LEN_MAX);
break;
}
if (data_len + 2 > remaining - 8) {
BTM_TRACE_ERROR("btm_ble_process_adv_pkt: data_len %u + data + rssi exceeds remaining %u", data_len, (UINT16)(remaining - 8));
break;

1
components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h
View File

@@ -480,6 +480,7 @@ void btm_ble_update_link_topology_mask(UINT8 role, BOOLEAN increase);
/* direct connection utility */
BOOLEAN btm_send_pending_direct_conn(void);
void btm_ble_enqueue_direct_conn_req(void *p_param);
void btm_ble_remove_direct_conn_req(void *p_param);
/* BLE address management */
void btm_gen_resolvable_private_addr (void *p_cmd_cplt_cback);