diff --git a/components/bt/host/bluedroid/api/esp_bt_device.c b/components/bt/host/bluedroid/api/esp_bt_device.c index d3229e5f5c7..bbd56cac986 100644 --- a/components/bt/host/bluedroid/api/esp_bt_device.c +++ b/components/bt/host/bluedroid/api/esp_bt_device.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -16,9 +16,7 @@ esp_err_t esp_bt_dev_register_callback(esp_bt_dev_cb_t callback) { - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (callback == NULL) { return ESP_ERR_INVALID_ARG; @@ -31,7 +29,7 @@ esp_err_t esp_bt_dev_register_callback(esp_bt_dev_cb_t callback) const uint8_t *esp_bt_dev_get_address(void) { if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return NULL; + return NULL; } return controller_get_interface()->get_address()->address; } @@ -97,6 +95,8 @@ esp_err_t esp_bt_dev_coex_status_config(esp_bt_dev_coex_type_t type, esp_bt_dev_ esp_err_t esp_bt_config_file_path_get(char *file_path) { + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + return btc_config_file_path_get(file_path); } diff --git a/components/bt/host/bluedroid/api/esp_bt_main.c b/components/bt/host/bluedroid/api/esp_bt_main.c index 61c07db7a6f..4bcd1c3caa5 100644 --- a/components/bt/host/bluedroid/api/esp_bt_main.c +++ b/components/bt/host/bluedroid/api/esp_bt_main.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -31,19 +31,19 @@ esp_err_t esp_bluedroid_enable(void) future_t **future_p; if (s_bt_host_state == ESP_BLUEDROID_STATUS_UNINITIALIZED) { - LOG_ERROR("Bludroid not initialised\n"); + LOG_ERROR("Bluedroid not initialised"); return ESP_ERR_INVALID_STATE; } if (s_bt_host_state == ESP_BLUEDROID_STATUS_ENABLED) { - LOG_ERROR("Bluedroid already enabled\n"); + LOG_ERROR("Bluedroid already enabled"); return ESP_ERR_INVALID_STATE; } future_p = btc_main_get_future_p(BTC_MAIN_ENABLE_FUTURE); *future_p = future_new(); if (*future_p == NULL) { - LOG_ERROR("Bluedroid enable failed\n"); + LOG_ERROR("Bluedroid enable failed"); return ESP_ERR_NO_MEM; } @@ -53,12 +53,13 @@ esp_err_t esp_bluedroid_enable(void) if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { future_free(*future_p); - LOG_ERROR("Bluedroid enable failed\n"); + *future_p = NULL; + LOG_ERROR("Bluedroid enable failed"); return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { - LOG_ERROR("Bluedroid enable failed\n"); + LOG_ERROR("Bluedroid enable failed"); return ESP_FAIL; } @@ -72,7 +73,7 @@ esp_err_t esp_bluedroid_disable(void) future_t **future_p; if (s_bt_host_state != ESP_BLUEDROID_STATUS_ENABLED) { - LOG_ERROR("Bluedroid already disabled\n"); + LOG_ERROR("Bluedroid already disabled"); return ESP_ERR_INVALID_STATE; } @@ -81,7 +82,7 @@ esp_err_t esp_bluedroid_disable(void) future_p = btc_main_get_future_p(BTC_MAIN_DISABLE_FUTURE); *future_p = future_new(); if (*future_p == NULL) { - LOG_ERROR("Bluedroid disable failed\n"); + LOG_ERROR("Bluedroid disable failed"); s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED; return ESP_ERR_NO_MEM; } @@ -91,13 +92,15 @@ esp_err_t esp_bluedroid_disable(void) msg.act = BTC_MAIN_ACT_DISABLE; if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { - LOG_ERROR("Bluedroid disable failed\n"); + LOG_ERROR("Bluedroid disable failed"); + future_free(*future_p); + *future_p = NULL; s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED; return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { - LOG_ERROR("Bluedroid disable failed\n"); + LOG_ERROR("Bluedroid disable failed"); s_bt_host_state = ESP_BLUEDROID_STATUS_ENABLED; return ESP_FAIL; } @@ -125,13 +128,13 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) #if (BT_CONTROLLER_INCLUDED == TRUE) if (esp_bt_controller_get_status() != ESP_BT_CONTROLLER_STATUS_ENABLED) { - LOG_ERROR("Controller not initialised\n"); + LOG_ERROR("Controller not initialised"); return ESP_ERR_INVALID_STATE; } #endif if (s_bt_host_state != ESP_BLUEDROID_STATUS_UNINITIALIZED) { - LOG_ERROR("Bluedroid already initialised\n"); + LOG_ERROR("Bluedroid already initialised"); return ESP_ERR_INVALID_STATE; } @@ -189,6 +192,7 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { LOG_ERROR("Bluedroid Initialize Fail"); future_free(*future_p); + *future_p = NULL; btc_deinit(); bluedroid_config_deinit(); #if HEAP_MEMORY_STATS @@ -222,20 +226,20 @@ esp_err_t esp_bluedroid_deinit(void) future_t **future_p; if (s_bt_host_state == ESP_BLUEDROID_STATUS_UNINITIALIZED) { - LOG_ERROR("Bluedroid already de-initialised\n"); + LOG_ERROR("Bluedroid already de-initialised"); return ESP_ERR_INVALID_STATE; } if (s_bt_host_state == ESP_BLUEDROID_STATUS_ENABLED || s_bt_host_state == ESP_BLUEDROID_STATUS_DISABLING) { - LOG_ERROR("Bludroid still enabled or stopping, disable first\n"); + LOG_ERROR("Bluedroid still enabled or stopping, disable first"); return ESP_ERR_INVALID_STATE; } future_p = btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE); *future_p = future_new(); if (*future_p == NULL) { - LOG_ERROR("Bluedroid de-initialise failed\n"); + LOG_ERROR("Bluedroid de-initialise failed"); return ESP_ERR_NO_MEM; } @@ -244,12 +248,14 @@ esp_err_t esp_bluedroid_deinit(void) msg.act = BTC_MAIN_ACT_DEINIT; if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { - LOG_ERROR("Bluedroid de-initialise failed\n"); + LOG_ERROR("Bluedroid de-initialise failed"); + future_free(*future_p); + *future_p = NULL; return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { - LOG_ERROR("Bluedroid de-initialise failed\n"); + LOG_ERROR("Bluedroid de-initialise failed"); return ESP_FAIL; } diff --git a/components/bt/host/bluedroid/api/esp_gap_bt_api.c b/components/bt/host/bluedroid/api/esp_gap_bt_api.c index 200630e11ab..49a3acd9727 100644 --- a/components/bt/host/bluedroid/api/esp_gap_bt_api.c +++ b/components/bt/host/bluedroid/api/esp_gap_bt_api.c @@ -22,9 +22,7 @@ esp_err_t esp_bt_gap_register_callback(esp_bt_gap_cb_t callback) { - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (callback == NULL) { return ESP_FAIL; @@ -39,9 +37,7 @@ esp_err_t esp_bt_gap_set_scan_mode(esp_bt_connection_mode_t c_mode, esp_bt_disco btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -57,9 +53,7 @@ esp_err_t esp_bt_gap_start_discovery(esp_bt_inq_mode_t mode, uint8_t inq_len, ui btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (mode != ESP_BT_INQ_MODE_GENERAL_INQUIRY && mode != ESP_BT_INQ_MODE_LIMITED_INQUIRY) { @@ -86,9 +80,7 @@ esp_err_t esp_bt_gap_cancel_discovery(void) { btc_msg_t msg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -102,9 +94,7 @@ esp_err_t esp_bt_gap_get_remote_services(esp_bd_addr_t remote_bda) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -119,8 +109,10 @@ esp_err_t esp_bt_gap_get_remote_service_record(esp_bd_addr_t remote_bda, esp_bt_ btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if (uuid == NULL) { + return ESP_ERR_INVALID_ARG; } msg.sig = BTC_SIG_API_CALL; @@ -166,9 +158,7 @@ esp_err_t esp_bt_gap_config_eir_data(esp_bt_eir_data_t *eir_data) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (eir_data == NULL) { return ESP_ERR_INVALID_ARG; @@ -199,9 +189,7 @@ esp_err_t esp_bt_gap_set_cod(esp_bt_cod_t cod, esp_bt_cod_mode_t mode) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); switch (mode) { case ESP_BT_SET_COD_RESERVED_2: @@ -236,6 +224,9 @@ esp_err_t esp_bt_gap_read_rssi_delta(esp_bd_addr_t remote_addr) { btc_msg_t msg; btc_gap_bt_args_t arg; + + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_READ_RSSI_DELTA; @@ -250,6 +241,8 @@ esp_err_t esp_bt_gap_read_acl_real_rssi(esp_bd_addr_t remote_addr) btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_READ_ACL_REAL_RSSI; @@ -262,6 +255,8 @@ esp_err_t esp_bt_gap_read_new_conn_tx_pwr_rng(void) { btc_msg_t msg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_READ_NEW_CONN_TX_PWR_LVL; @@ -274,6 +269,8 @@ esp_err_t esp_bt_gap_write_new_conn_tx_pwr_rng(int8_t pwr_lvl_min, int8_t pwr_lv btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (pwr_lvl_min < ESP_TX_PWR_LVL_MIN || pwr_lvl_min > ESP_TX_PWR_LVL_MAX || pwr_lvl_max < ESP_TX_PWR_LVL_MIN || pwr_lvl_max > ESP_TX_PWR_LVL_MAX || pwr_lvl_min > pwr_lvl_max) { @@ -295,6 +292,8 @@ esp_err_t esp_bt_gap_read_tx_pwr_lvl(esp_bt_gap_tx_pwr_lvl_type_t type) btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + #if (ESP_BT_CLASSIC_ENABLE_POWER_CTRL_VSC == TRUE) if (type >= ESP_BT_GAP_TX_PWR_LVL_TYPE_MAX) { return ESP_ERR_INVALID_ARG; @@ -318,6 +317,8 @@ esp_err_t esp_bt_gap_write_tx_pwr_lvl(esp_bt_gap_tx_pwr_lvl_type_t type, int8_t btc_msg_t msg; btc_gap_bt_args_t arg; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + #if (ESP_BT_CLASSIC_ENABLE_POWER_CTRL_VSC == TRUE) if (type >= ESP_BT_GAP_TX_PWR_LVL_TYPE_MAX || tx_power < ESP_TX_PWR_LVL_MIN || tx_power > ESP_TX_PWR_LVL_MAX) { @@ -346,9 +347,7 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -360,9 +359,8 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr) int esp_bt_gap_get_bond_device_num(void) { - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + return btc_storage_get_num_bt_bond_devices(); } @@ -370,14 +368,12 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list) { int ret; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (dev_num == NULL || dev_list == NULL) { return ESP_ERR_INVALID_ARG; } - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } - ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, dev_num); return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -388,8 +384,12 @@ esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, e btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if (pin_type == ESP_BT_PIN_TYPE_FIXED) { + if ((pin_code == NULL) || (pin_code_len == 0) || (pin_code_len > ESP_BT_PIN_CODE_LEN)) { + return ESP_ERR_INVALID_ARG; + } } msg.sig = BTC_SIG_API_CALL; @@ -413,17 +413,22 @@ esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_c btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if (accept && ((pin_code == NULL) || (pin_code_len == 0) || (pin_code_len > ESP_BT_PIN_CODE_LEN))) { + return ESP_ERR_INVALID_ARG; } + memset(&arg, 0, sizeof(btc_gap_bt_args_t)); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_ACT_PIN_REPLY; arg.pin_reply.accept = accept; - arg.pin_reply.pin_code_len = pin_code_len; memcpy(arg.pin_reply.bda.address, bd_addr, sizeof(esp_bd_addr_t)); - memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len); + if (accept) { + arg.pin_reply.pin_code_len = pin_code_len; + memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len); + } return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), btc_gap_bt_arg_deep_copy, btc_gap_bt_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -435,8 +440,11 @@ esp_err_t esp_bt_gap_set_security_param(esp_bt_sp_param_t param_type, btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + + if ((param_type > ESP_BT_SP_IOCAP_MODE) || (value == NULL) || + ((param_type == ESP_BT_SP_IOCAP_MODE) && (len < 1))) { + return ESP_ERR_INVALID_ARG; } if (!(bluedroid_config_get()->get_ssp_enabled())) { @@ -460,9 +468,7 @@ esp_err_t esp_bt_gap_ssp_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint3 btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (!(bluedroid_config_get()->get_ssp_enabled())) { ESP_LOGE(TAG, "%s is not supported when `ssp_en` in `esp_bluedroid_config_t` is disabled!", __func__); @@ -484,9 +490,7 @@ esp_err_t esp_bt_gap_ssp_confirm_reply(esp_bd_addr_t bd_addr, bool accept) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (!(bluedroid_config_get()->get_ssp_enabled())) { ESP_LOGE(TAG, "%s is not supported when `ssp_en` in `esp_bluedroid_config_t` is disabled!", __func__); @@ -507,9 +511,7 @@ esp_err_t esp_bt_gap_set_afh_channels(esp_bt_gap_afh_channels channels) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -525,9 +527,7 @@ esp_err_t esp_bt_gap_read_remote_name(esp_bd_addr_t remote_bda) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BT; @@ -542,9 +542,7 @@ esp_err_t esp_bt_gap_set_qos(esp_bd_addr_t remote_bda, uint32_t t_poll) btc_msg_t msg; btc_gap_bt_args_t arg; - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (t_poll < ESP_BT_GAP_TPOLL_MIN || t_poll > ESP_BT_GAP_TPOLL_MAX) { return ESP_ERR_INVALID_ARG; @@ -565,7 +563,7 @@ esp_err_t esp_bt_gap_set_page_timeout(uint16_t page_to) btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } if (page_to < HCI_MIN_PAGE_TOUT) { return ESP_ERR_INVALID_ARG; @@ -584,7 +582,7 @@ esp_err_t esp_bt_gap_get_page_timeout(void) btc_msg_t msg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } msg.sig = BTC_SIG_API_CALL; @@ -600,7 +598,7 @@ esp_err_t esp_bt_gap_set_acl_pkt_types(esp_bd_addr_t remote_bda, uint16_t pkt_ty btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } msg.sig = BTC_SIG_API_CALL; @@ -619,7 +617,7 @@ esp_err_t esp_bt_gap_set_min_enc_key_size(uint8_t key_size) btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } if (key_size < ESP_BT_ENC_KEY_SIZE_CTRL_MIN || key_size > ESP_BT_ENC_KEY_SIZE_CTRL_MAX) { @@ -641,7 +639,7 @@ esp_err_t esp_bt_gap_set_device_name(const char *name) btc_gap_bt_args_t arg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } if ((!name) || (strlen(name) > BTC_MAX_LOC_BD_NAME_LEN)) { return ESP_ERR_INVALID_ARG; @@ -661,7 +659,7 @@ esp_err_t esp_bt_gap_get_device_name(void) btc_msg_t msg; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; + return ESP_ERR_INVALID_STATE; } msg.sig = BTC_SIG_API_CALL; @@ -677,9 +675,7 @@ esp_err_t esp_bt_gap_get_profile_status(esp_bt_gap_profile_status_t *profile_sta return ESP_ERR_INVALID_ARG; } - if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { - return ESP_ERR_INVALID_STATE; - } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); memset(profile_status, 0, sizeof(esp_bt_gap_profile_status_t)); btc_gap_bt_status_get(profile_status); diff --git a/components/bt/host/bluedroid/api/esp_hidd_api.c b/components/bt/host/bluedroid/api/esp_hidd_api.c index 483ba412919..fafda6ad581 100644 --- a/components/bt/host/bluedroid/api/esp_hidd_api.c +++ b/components/bt/host/bluedroid/api/esp_hidd_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 * @@ -20,7 +20,7 @@ esp_err_t esp_bt_hid_device_register_callback(esp_hd_cb_t callback) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (callback == NULL) { - return ESP_FAIL; + return ESP_ERR_INVALID_ARG; } btc_profile_cb_set(BTC_PID_HD, callback); @@ -58,6 +58,16 @@ esp_err_t esp_bt_hid_device_register_app(esp_hidd_app_param_t* app_param, esp_hi { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if ((app_param == NULL) || (in_qos == NULL) || (out_qos == NULL)) { + return ESP_ERR_INVALID_ARG; + } + if ((app_param->desc_list_len <= 0) || (app_param->desc_list_len > ESP_HIDD_APP_DESC_LIST_LEN_MAX) || (app_param->desc_list == NULL)) { + return ESP_ERR_INVALID_ARG; + } + if ((app_param->name == NULL) || (app_param->description == NULL) || (app_param->provider == NULL)) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; btc_hidd_args_t args; memset(&args, 0, sizeof(btc_hidd_args_t)); @@ -69,7 +79,8 @@ esp_err_t esp_bt_hid_device_register_app(esp_hidd_app_param_t* app_param, esp_hi msg.pid = BTC_PID_HD; msg.act = BTC_HD_REGISTER_APP_EVT; - bt_status_t stat = btc_transfer_context(&msg, &args, sizeof(btc_hidd_args_t), NULL, NULL); + bt_status_t stat = btc_transfer_context(&msg, &args, sizeof(btc_hidd_args_t), + btc_hd_arg_deep_copy, btc_hd_call_arg_deep_free); return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL; } @@ -90,6 +101,10 @@ esp_err_t esp_bt_hid_device_connect(esp_bd_addr_t bd_addr) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; btc_hidd_args_t args; memset(&args, 0, sizeof(btc_hidd_args_t)); @@ -120,6 +135,10 @@ esp_err_t esp_bt_hid_device_send_report(esp_hidd_report_type_t type, uint8_t id, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if ((type < ESP_HIDD_REPORT_TYPE_OTHER) || (type > ESP_HIDD_REPORT_TYPE_INTRDATA) || (data == NULL) || (len == 0)) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HD; @@ -141,6 +160,11 @@ esp_err_t esp_bt_hid_device_report_error(esp_hidd_handshake_error_t error) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if ((error < ESP_HID_PAR_HANDSHAKE_RSP_SUCCESS) || (error > ESP_HID_PAR_HANDSHAKE_RSP_ERR_FATAL) || + ((error > ESP_HID_PAR_HANDSHAKE_RSP_ERR_INVALID_PARAM) && (error < ESP_HID_PAR_HANDSHAKE_RSP_ERR_UNKNOWN))) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HD; diff --git a/components/bt/host/bluedroid/api/esp_hidh_api.c b/components/bt/host/bluedroid/api/esp_hidh_api.c index f1c39bded88..9b367ec3176 100644 --- a/components/bt/host/bluedroid/api/esp_hidh_api.c +++ b/components/bt/host/bluedroid/api/esp_hidh_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 * @@ -18,9 +18,8 @@ esp_err_t esp_bt_hid_host_register_callback(esp_hh_cb_t callback) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if (callback == NULL) { - return ESP_FAIL; + return ESP_ERR_INVALID_ARG; } btc_profile_cb_set(BTC_PID_HH, callback); @@ -30,7 +29,6 @@ esp_err_t esp_bt_hid_host_register_callback(esp_hh_cb_t callback) esp_err_t esp_bt_hid_host_init(void) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; @@ -44,7 +42,6 @@ esp_err_t esp_bt_hid_host_init(void) esp_err_t esp_bt_hid_host_deinit(void) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - btc_msg_t msg; msg.sig = BTC_SIG_API_CALL; @@ -61,6 +58,10 @@ esp_err_t esp_bt_hid_host_connect(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_CONNECT_EVT; @@ -77,6 +78,10 @@ esp_err_t esp_bt_hid_host_disconnect(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_DISCONNECT_EVT; @@ -93,6 +98,10 @@ esp_err_t esp_bt_hid_host_virtual_cable_unplug(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_UNPLUG_EVT; @@ -106,6 +115,10 @@ esp_err_t esp_bt_hid_host_virtual_cable_unplug(esp_bd_addr_t bd_addr) esp_err_t esp_bt_hid_host_set_info(esp_bd_addr_t bd_addr, esp_hidh_hid_info_t *hid_info) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if ((bd_addr == NULL) || (hid_info == NULL) || (hid_info->dl_len < 0) || (hid_info->dl_len > BTHH_MAX_DSC_LEN)) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; btc_hidh_args_t arg; @@ -127,6 +140,10 @@ esp_err_t esp_bt_hid_host_get_protocol(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_GET_PROTO_EVT; @@ -143,6 +160,10 @@ esp_err_t esp_bt_hid_host_set_protocol(esp_bd_addr_t bd_addr, esp_hidh_protocol_ btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_SET_PROTO_EVT; @@ -160,6 +181,10 @@ esp_err_t esp_bt_hid_host_get_idle(esp_bd_addr_t bd_addr) btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_GET_IDLE_EVT; @@ -176,6 +201,10 @@ esp_err_t esp_bt_hid_host_set_idle(esp_bd_addr_t bd_addr, uint16_t idle_time) btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_SET_IDLE_EVT; @@ -194,6 +223,10 @@ esp_err_t esp_bt_hid_host_get_report(esp_bd_addr_t bd_addr, esp_hidh_report_type btc_msg_t msg; btc_hidh_args_t arg; + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_HH; msg.act = BTC_HH_GET_REPORT_EVT; @@ -211,6 +244,10 @@ esp_err_t esp_bt_hid_host_set_report(esp_bd_addr_t bd_addr, esp_hidh_report_type size_t len) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if ((bd_addr == NULL) || (report == NULL) || (len == 0)) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; btc_hidh_args_t arg; @@ -231,6 +268,10 @@ esp_err_t esp_bt_hid_host_set_report(esp_bd_addr_t bd_addr, esp_hidh_report_type esp_err_t esp_bt_hid_host_send_data(esp_bd_addr_t bd_addr, uint8_t *data, size_t len) { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if ((bd_addr == NULL) || (data == NULL) || (len == 0)) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg; btc_hidh_args_t arg; diff --git a/components/bt/host/bluedroid/api/esp_sdp_api.c b/components/bt/host/bluedroid/api/esp_sdp_api.c index 41e143a2ebc..6985b905d65 100644 --- a/components/bt/host/bluedroid/api/esp_sdp_api.c +++ b/components/bt/host/bluedroid/api/esp_sdp_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -36,13 +36,13 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record) case ESP_SDP_TYPE_MAP_MAS: if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) { LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n"); - ret = false; + ret = false; } break; case ESP_SDP_TYPE_PBAP_PSE: if (record->pse.supported_repositories >> 8) { LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n"); - ret = false; + ret = false; } break; @@ -50,7 +50,8 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record) break; } if (record->hdr.type != ESP_SDP_TYPE_DIP_SERVER) { - if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX || + if (record->hdr.service_name == NULL || + record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX || strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) { LOG_ERROR("Invalid server name!\n"); ret = false; @@ -167,6 +168,7 @@ esp_err_t esp_sdp_remove_record(int record_handle) msg.pid = BTC_PID_SDP; msg.act = BTC_SDP_ACT_REMOVE_RECORD; + memset(&arg, 0, sizeof(btc_sdp_args_t)); arg.remove_record.record_handle = record_handle; /* Switch to BTC context */ diff --git a/components/bt/host/bluedroid/api/esp_spp_api.c b/components/bt/host/bluedroid/api/esp_spp_api.c index 18ef661c165..16847efe341 100644 --- a/components/bt/host/bluedroid/api/esp_spp_api.c +++ b/components/bt/host/bluedroid/api/esp_spp_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -18,7 +18,6 @@ static const uint8_t UUID_SPP[16] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00, 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB }; -static tSDP_UUID sdp_uuid; esp_err_t esp_spp_register_callback(esp_spp_cb_t callback) { @@ -50,8 +49,8 @@ esp_err_t esp_spp_enhanced_init(const esp_spp_cfg_t *cfg) btc_spp_args_t arg; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if (cfg->mode == ESP_SPP_MODE_VFS && (cfg->tx_buffer_size < ESP_SPP_MIN_TX_BUFFER_SIZE || - cfg->tx_buffer_size > ESP_SPP_MAX_TX_BUFFER_SIZE)) { + if (!cfg || (cfg->mode == ESP_SPP_MODE_VFS && (cfg->tx_buffer_size < ESP_SPP_MIN_TX_BUFFER_SIZE || + cfg->tx_buffer_size > ESP_SPP_MAX_TX_BUFFER_SIZE))) { LOG_WARN("Invalid tx buffer size"); return ESP_ERR_INVALID_ARG; } @@ -70,26 +69,26 @@ esp_err_t esp_spp_enhanced_init(const esp_spp_cfg_t *cfg) esp_err_t esp_spp_deinit(void) { btc_msg_t msg; - btc_spp_args_t arg; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_SPP; msg.act = BTC_SPP_ACT_UNINIT; - return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); + return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } esp_err_t esp_spp_start_discovery(esp_bd_addr_t bd_addr) { - sdp_uuid.len = 16; - memcpy(sdp_uuid.uu.uuid128, UUID_SPP, sizeof(sdp_uuid.uu.uuid128)); - btc_msg_t msg; btc_spp_args_t arg; + tSDP_UUID sdp_uuid; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + sdp_uuid.len = 16; + memcpy(sdp_uuid.uu.uuid128, UUID_SPP, sizeof(sdp_uuid.uu.uuid128)); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_SPP; msg.act = BTC_SPP_ACT_START_DISCOVERY; @@ -113,7 +112,7 @@ esp_err_t esp_spp_connect(esp_spp_sec_t sec_mask, sec_mask != ESP_SPP_SEC_AUTHENTICATE && sec_mask != (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT)) { LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHENTICATE" - "or (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only\n"); + "or (ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only"); } msg.sig = BTC_SIG_API_CALL; @@ -163,7 +162,7 @@ esp_err_t esp_spp_start_srv_with_cfg(const esp_spp_start_srv_cfg_t *cfg) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (cfg == NULL || cfg->name == NULL || strlen(cfg->name) > ESP_SPP_SERVER_NAME_MAX) { - LOG_ERROR("Invalid server name!\n"); + LOG_ERROR("Invalid server name!"); return ESP_ERR_INVALID_ARG; } @@ -176,7 +175,7 @@ esp_err_t esp_spp_start_srv_with_cfg(const esp_spp_start_srv_cfg_t *cfg) LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHENTICATE," "(ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT)," "ESP_SPP_SEC_IN_16_DIGITS, (ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE), or" - "(ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only\n"); + "(ESP_SPP_SEC_IN_16_DIGITS | ESP_SPP_SEC_AUTHENTICATE | ESP_SPP_SEC_ENCRYPT) only"); } msg.sig = BTC_SIG_API_CALL; @@ -214,7 +213,7 @@ esp_err_t esp_spp_stop_srv_scn(uint8_t scn) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if ((scn == 0) || (scn >= PORT_MAX_RFC_PORTS)) { - LOG_ERROR("Invalid SCN!\n"); + LOG_ERROR("Invalid SCN!"); return ESP_ERR_INVALID_ARG; } @@ -232,7 +231,7 @@ esp_err_t esp_spp_write(uint32_t handle, int len, uint8_t *p_data) ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (len <= 0 || p_data == NULL) { - LOG_ERROR("Invalid data or len!\n"); + LOG_ERROR("Invalid data or len!"); return ESP_ERR_INVALID_ARG; } @@ -242,27 +241,25 @@ esp_err_t esp_spp_write(uint32_t handle, int len, uint8_t *p_data) esp_err_t esp_spp_vfs_register(void) { btc_msg_t msg; - btc_spp_args_t arg; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_SPP; msg.act = BTC_SPP_ACT_VFS_REGISTER; - return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); + return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } esp_err_t esp_spp_vfs_unregister(void) { btc_msg_t msg; - btc_spp_args_t arg; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_SPP; msg.act = BTC_SPP_ACT_VFS_UNREGISTER; - return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); + return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } esp_err_t esp_spp_get_profile_status(esp_spp_profile_status_t *profile_status) diff --git a/components/bt/host/bluedroid/api/include/api/esp_hidd_api.h b/components/bt/host/bluedroid/api/include/api/esp_hidd_api.h index 2348e752d54..d4ae348d338 100644 --- a/components/bt/host/bluedroid/api/include/api/esp_hidd_api.h +++ b/components/bt/host/bluedroid/api/include/api/esp_hidd_api.h @@ -28,6 +28,9 @@ extern "C" { #define ESP_HID_CLASS_MIC (0x20<<2) /*!< pointing device */ #define ESP_HID_CLASS_COM (0x30<<2) /*!< combo keyboard/pointing */ +/** Maximum length of HID Device descriptor list */ +#define ESP_HIDD_APP_DESC_LIST_LEN_MAX 2048 + /** * @brief HIDD handshake result code */ diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c b/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c index 35727779ee8..31e1405b0bd 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_pm.c @@ -433,10 +433,10 @@ static void bta_dm_pm_cback(tBTA_SYS_CONN_STATUS status, UINT8 id, UINT8 app_id, ((NULL != (p = BTM_ReadRemoteFeatures (peer_addr))) && HCI_SNIFF_SUB_RATE_SUPPORTED(p)) && (index == BTA_DM_PM_SSR0)) { if (status == BTA_SYS_SCO_OPEN) { - APPL_TRACE_DEBUG("%s: SCO inactive, reset SSR to zero", __func__); + APPL_TRACE_DEBUG("%s: SCO active, reset SSR to zero", __func__); BTM_SetSsrParams (peer_addr, 0, 0, 0 ); } else if (status == BTA_SYS_SCO_CLOSE) { - APPL_TRACE_DEBUG("%s: SCO active, back to old SSR", __func__); + APPL_TRACE_DEBUG("%s: SCO inactive, back to old SSR", __func__); bta_dm_pm_ssr(peer_addr); } } @@ -522,6 +522,10 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request, } } + if (j > p_bta_dm_pm_cfg[0].app_id) { + continue; + } + p_pm_cfg = &p_bta_dm_pm_cfg[j]; p_pm_spec = &p_bta_dm_pm_spec[p_pm_cfg->spec_idx]; p_act0 = &p_pm_spec->actn_tbl[p_srvcs->state][0]; @@ -617,8 +621,8 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request, } return; } - /* if pending power mode timer expires, and currecnt link is in a - lower power mode than current profile requirement, igonre it */ + /* if pending power mode timer expires, and current link is in a + lower power mode than current profile requirement, ignore it */ if (pm_req == BTA_DM_PM_EXECUTE && pm_request < pm_action) { APPL_TRACE_ERROR("Ignore the power mode request: %d", pm_request) return; @@ -640,7 +644,7 @@ static void bta_dm_pm_set_mode(BD_ADDR peer_addr, tBTA_DM_PM_ACTION pm_request, } /******************************************************************************* ** -** Function bta_ag_pm_park +** Function bta_dm_pm_park ** ** Description Switch to park mode. ** @@ -665,7 +669,7 @@ static BOOLEAN bta_dm_pm_park(BD_ADDR peer_addr) /******************************************************************************* ** -** Function bta_ag_pm_sniff +** Function bta_dm_pm_sniff ** ** Description Switch to sniff mode. ** @@ -757,6 +761,10 @@ static void bta_dm_pm_ssr(BD_ADDR peer_addr) } } + if (j > p_bta_dm_pm_cfg[0].app_id) { + continue; + } + /* find the ssr index with the smallest max latency. */ p_spec_cur = &p_bta_dm_ssr_spec[p_bta_dm_pm_spec[p_bta_dm_pm_cfg[j].spec_idx].ssr]; p_spec = &p_bta_dm_ssr_spec[ssr]; diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c b/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c index 19a31b9449d..858f93cf6c0 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_qos.c @@ -33,7 +33,7 @@ void bta_dm_set_qos(tBTA_DM_MSG *p_data) { - FLOW_SPEC p_flow = { + FLOW_SPEC flow = { .qos_flags = 0, /* TBD */ .service_type = NO_TRAFFIC, /* service_type */ .token_rate = 0, /* bytes/second */ @@ -43,7 +43,7 @@ void bta_dm_set_qos(tBTA_DM_MSG *p_data) .delay_variation = 0xFFFFFFFF /* microseconds */ }; - tBTM_STATUS status = BTM_SetQoS (p_data->qos_set.bd_addr, &p_flow, p_data->qos_set.p_cb); + tBTM_STATUS status = BTM_SetQoS (p_data->qos_set.bd_addr, &flow, p_data->qos_set.p_cb); if(status != BTM_CMD_STARTED) { APPL_TRACE_ERROR("%s ERROR: 0x%x\n", __func__, status); diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c b/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c index df91799a872..c75e6476a21 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_sco.c @@ -20,7 +20,7 @@ * * This file contains the down sampling utility to convert PCM samples in * 16k/32k/48k/44.1k/22050/11025 sampling rate into 8K/16bits samples - * required for SCO channel format. One API function isprovided and only + * required for SCO channel format. One API function is provided and only * possible to be used when transmitting SCO data is sent via HCI * interface. * @@ -76,10 +76,12 @@ static tBTA_DM_PCM_RESAMPLE_CB* p_bta_dm_pcm_cb; #define CHECK_SATURATION16(x) \ + do { \ if (x > 32767) \ x = 32767; \ else if (x < -32768) \ - x = -32768; + x = -32768; \ + } while (0); //////////////////////////////////////////////////////////////////////////////////////////////////// // @@ -630,8 +632,10 @@ void BTA_DmPcmInitSamples (UINT32 src_sps, UINT32 bits, UINT32 n_channels) ** *******************************************************************************/ void BTA_DmPcmDeinitSamples(void) { - osi_free(p_bta_dm_pcm_cb); - p_bta_dm_pcm_cb = NULL; + if (p_bta_dm_pcm_cb) { + osi_free(p_bta_dm_pcm_cb); + p_bta_dm_pcm_cb = NULL; + } } /************************************************************************************** diff --git a/components/bt/host/bluedroid/bta/hd/bta_hd_act.c b/components/bt/host/bluedroid/bta/hd/bta_hd_act.c index 220b86cf2f6..18bc0493801 100644 --- a/components/bt/host/bluedroid/bta/hd/bta_hd_act.c +++ b/components/bt/host/bluedroid/bta/hd/bta_hd_act.c @@ -27,6 +27,7 @@ #include "bta/bta_sys.h" #include "bta_hd_int.h" +#include "bta/utl.h" #include "osi/allocator.h" #include "osi/osi.h" #include "stack/btm_api.h" @@ -42,7 +43,7 @@ static bool check_descriptor(uint8_t *data, uint16_t length, bool *has_report_id uint8_t item = *ptr++; switch (item) { case 0xfe: // long item indicator - if (ptr < data + length) { + if ((ptr < data + length) && ((*ptr) + 2 <= (data + length - ptr))) { ptr += ((*ptr) + 2); } else { return false; @@ -50,6 +51,7 @@ static bool check_descriptor(uint8_t *data, uint16_t length, bool *has_report_id break; case 0x85: // Report ID *has_report_id = TRUE; + /* fall through */ default: ptr += (item & 0x03); break; @@ -522,6 +524,11 @@ extern void bta_hd_close_act(tBTA_HD_DATA *p_data) extern void bta_hd_intr_data_act(tBTA_HD_DATA *p_data) { tBTA_HD_CBACK_DATA *p_cback = (tBTA_HD_CBACK_DATA *)p_data; + if (!p_cback || !p_cback->p_data) { + APPL_TRACE_ERROR("no DATA request on intr"); + return; + } + BT_HDR *p_msg = p_cback->p_data; uint16_t len = p_msg->len; uint8_t *p_buf = (uint8_t *)(p_msg + 1) + p_msg->offset; @@ -530,6 +537,9 @@ extern void bta_hd_intr_data_act(tBTA_HD_DATA *p_data) APPL_TRACE_API("%s", __func__); if (bta_hd_cb.use_report_id || bta_hd_cb.boot_mode) { + if (len < 1) { + goto _exit; + } ret.report_id = *p_buf; len--; p_buf++; @@ -540,6 +550,8 @@ extern void bta_hd_intr_data_act(tBTA_HD_DATA *p_data) ret.len = len; ret.p_data = p_buf; (*bta_hd_cb.p_cback)(BTA_HD_INTR_DATA_EVT, (tBTA_HD *)&ret); + +_exit: if (p_msg) { osi_free(p_msg); } @@ -557,6 +569,11 @@ extern void bta_hd_intr_data_act(tBTA_HD_DATA *p_data) extern void bta_hd_get_report_act(tBTA_HD_DATA *p_data) { tBTA_HD_CBACK_DATA *p_cback = (tBTA_HD_CBACK_DATA *)p_data; + if (!p_cback || !p_cback->p_data) { + APPL_TRACE_ERROR("no DATA request on GET_REPORT"); + return; + } + bool rep_size_follows = p_cback->data; BT_HDR *p_msg = p_cback->p_data; uint8_t *p_buf = (uint8_t *)(p_msg + 1) + p_msg->offset; @@ -566,7 +583,7 @@ extern void bta_hd_get_report_act(tBTA_HD_DATA *p_data) APPL_TRACE_API("%s", __func__); if (remaining_len < 1) { APPL_TRACE_ERROR("%s invalid data, remaining_len:%d", __func__, remaining_len); - return; + goto _exit; } ret.report_type = *p_buf & HID_PAR_REP_TYPE_MASK; @@ -576,7 +593,7 @@ extern void bta_hd_get_report_act(tBTA_HD_DATA *p_data) if (bta_hd_cb.use_report_id) { if (remaining_len < 1) { APPL_TRACE_ERROR("%s invalid data, remaining_len:%d", __func__, remaining_len); - return; + goto _exit; } ret.report_id = *p_buf; p_buf++; @@ -586,12 +603,14 @@ extern void bta_hd_get_report_act(tBTA_HD_DATA *p_data) if (rep_size_follows) { if (remaining_len < 2) { APPL_TRACE_ERROR("%s invalid data, remaining_len:%d", __func__, remaining_len); - return; + goto _exit; } ret.buffer_size = *p_buf | (*(p_buf + 1) << 8); } (*bta_hd_cb.p_cback)(BTA_HD_GET_REPORT_EVT, (tBTA_HD *)&ret); + +_exit: if (p_msg) { osi_free(p_msg); } @@ -609,6 +628,11 @@ extern void bta_hd_get_report_act(tBTA_HD_DATA *p_data) extern void bta_hd_set_report_act(tBTA_HD_DATA *p_data) { tBTA_HD_CBACK_DATA *p_cback = (tBTA_HD_CBACK_DATA *)p_data; + if (!p_cback || !p_cback->p_data) { + APPL_TRACE_ERROR("no DATA request on SET_REPORT"); + return; + } + BT_HDR *p_msg = p_cback->p_data; uint16_t len = p_msg->len; uint8_t *p_buf = (uint8_t *)(p_msg + 1) + p_msg->offset; @@ -616,11 +640,18 @@ extern void bta_hd_set_report_act(tBTA_HD_DATA *p_data) APPL_TRACE_API("%s", __func__); + if (len < 1) { + goto _exit; + } + ret.report_type = *p_buf & HID_PAR_REP_TYPE_MASK; p_buf++; len--; if (bta_hd_cb.use_report_id || bta_hd_cb.boot_mode) { + if (len < 1) { + goto _exit; + } ret.report_id = *p_buf; len--; p_buf++; @@ -631,6 +662,8 @@ extern void bta_hd_set_report_act(tBTA_HD_DATA *p_data) ret.len = len; ret.p_data = p_buf; (*bta_hd_cb.p_cback)(BTA_HD_SET_REPORT_EVT, (tBTA_HD *)&ret); + +_exit: if (p_msg) { osi_free(p_msg); } @@ -797,13 +830,15 @@ static void bta_hd_cback(BD_ADDR bd_addr, uint8_t event, uint32_t data, BT_HDR * } if (sm_event != BTA_HD_INVALID_EVT && - (p_buf = (tBTA_HD_CBACK_DATA *)osi_malloc(sizeof(tBTA_HD_CBACK_DATA) + sizeof(BT_HDR))) != NULL) { + (p_buf = (tBTA_HD_CBACK_DATA *)osi_malloc(sizeof(tBTA_HD_CBACK_DATA))) != NULL) { p_buf->hdr.event = sm_event; bdcpy(p_buf->addr, bd_addr); p_buf->data = data; p_buf->p_data = pdata; bta_sys_sendmsg(p_buf); + } else { + utl_freebuf((void **)&pdata); } } #endif /* BTA_HD_INCLUDED */ diff --git a/components/bt/host/bluedroid/bta/hd/bta_hd_api.c b/components/bt/host/bluedroid/bta/hd/bta_hd_api.c index 36aa540d295..ea27978984c 100644 --- a/components/bt/host/bluedroid/bta/hd/bta_hd_api.c +++ b/components/bt/host/bluedroid/bta/hd/bta_hd_api.c @@ -49,9 +49,9 @@ void BTA_HdEnable(tBTA_HD_CBACK *p_cback) { tBTA_HD_API_ENABLE *p_buf; APPL_TRACE_API("%s", __func__); - bta_sys_register(BTA_ID_HD, &bta_hd_reg); - p_buf = (tBTA_HD_API_ENABLE *)osi_malloc((uint16_t)sizeof(tBTA_HD_API_ENABLE)); + p_buf = (tBTA_HD_API_ENABLE *)osi_malloc(sizeof(tBTA_HD_API_ENABLE)); if (p_buf != NULL) { + bta_sys_register(BTA_ID_HD, &bta_hd_reg); memset(p_buf, 0, sizeof(tBTA_HD_API_ENABLE)); p_buf->hdr.event = BTA_HD_API_ENABLE_EVT; p_buf->p_cback = p_cback; @@ -89,6 +89,10 @@ void BTA_HdDisable(void) ******************************************************************************/ extern void BTA_HdRegisterApp(tBTA_HD_APP_INFO *p_app_info, tBTA_HD_QOS_INFO *p_in_qos, tBTA_HD_QOS_INFO *p_out_qos) { + if (p_app_info == NULL || p_in_qos == NULL || p_out_qos == NULL) { + APPL_TRACE_ERROR("bad app_info(%p), in_qos(%p) or out_qos(%p)", p_app_info, p_in_qos, p_out_qos); + return; + } /* Validate descriptor length before copying */ if (p_app_info->descriptor.dl_len > BTA_HD_APP_DESCRIPTOR_LEN) { diff --git a/components/bt/host/bluedroid/bta/hd/bta_hd_main.c b/components/bt/host/bluedroid/bta/hd/bta_hd_main.c index 7faaf2d6cd3..2379aefd678 100644 --- a/components/bt/host/bluedroid/bta/hd/bta_hd_main.c +++ b/components/bt/host/bluedroid/bta/hd/bta_hd_main.c @@ -18,7 +18,7 @@ ******************************************************************************/ /****************************************************************************** * - * This file contains the HID host main functions and state machine. + * This file contains the HID device main functions and state machine. * ******************************************************************************/ #include "common/bt_target.h" @@ -204,13 +204,11 @@ void bta_hd_sm_execute(uint16_t event, tBTA_HD_DATA *p_data) tBTA_HD_ST_TBL state_table; tBTA_HD_STATE prev_state; uint8_t action; - tBTA_HD cback_data; APPL_TRACE_EVENT("%s: state=%s (%d) event=%s (%d)", __func__, bta_hd_state_code(bta_hd_cb.state), bta_hd_cb.state, bta_hd_evt_code(event), event); prev_state = bta_hd_cb.state; - memset(&cback_data, 0, sizeof(tBTA_HD)); state_table = bta_hd_st_tbl[bta_hd_cb.state]; event &= 0xff; diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_act.c b/components/bt/host/bluedroid/bta/hh/bta_hh_act.c index 6d933ee8700..568003dbccb 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_act.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_act.c @@ -104,7 +104,9 @@ void bta_hh_api_enable(tBTA_HH_DATA *p_data) #endif { /* signal BTA call back event */ - (* bta_hh_cb.p_cback)(BTA_HH_ENABLE_EVT, (tBTA_HH *)&status); + if (bta_hh_cb.p_cback) { + (* bta_hh_cb.p_cback)(BTA_HH_ENABLE_EVT, (tBTA_HH *)&status); + } } } /******************************************************************************* @@ -754,7 +756,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data) /* fall through */ case BTA_HH_SET_RPT_EVT: /* fall through */ - case BTA_HH_SET_IDLE_EVT : + case BTA_HH_SET_IDLE_EVT: /* fall through */ default: #if BTA_HH_DEBUG @@ -1192,6 +1194,8 @@ static void bta_hh_cback (UINT8 dev_handle, BD_ADDR addr, UINT8 event, p_buf->p_data = pdata; bta_sys_sendmsg(p_buf); + } else { + utl_freebuf((void **)&pdata); } } diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_api.c b/components/bt/host/bluedroid/bta/hh/bta_hh_api.c index 157e4b6ac67..8550a0e06e1 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_api.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_api.c @@ -67,7 +67,7 @@ void BTA_HhEnable(tBTA_SEC sec_mask, tBTA_HH_CBACK *p_cback) bta_sys_register(BTA_ID_HH, &bta_hh_reg); APPL_TRACE_API("%s sec_mask:0x%x p_cback:%p", __func__, sec_mask, p_cback); - p_buf = (tBTA_HH_API_ENABLE *)osi_malloc((UINT16)sizeof(tBTA_HH_API_ENABLE)); + p_buf = (tBTA_HH_API_ENABLE *)osi_malloc(sizeof(tBTA_HH_API_ENABLE)); if (p_buf != NULL) { memset(p_buf, 0, sizeof(tBTA_HH_API_ENABLE)); @@ -114,7 +114,7 @@ void BTA_HhClose(UINT8 dev_handle) { BT_HDR *p_buf; - if ((p_buf = (BT_HDR *)osi_malloc((UINT16)sizeof(BT_HDR))) != NULL) { + if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR))) != NULL) { memset(p_buf, 0, sizeof(BT_HDR)); p_buf->event = BTA_HH_API_CLOSE_EVT; p_buf->layer_specific = (UINT16) dev_handle; @@ -137,7 +137,7 @@ void BTA_HhOpen(BD_ADDR dev_bda, tBTA_HH_PROTO_MODE mode, tBTA_SEC sec_mask) { tBTA_HH_API_CONN *p_buf; - p_buf = (tBTA_HH_API_CONN *)osi_malloc((UINT16)sizeof(tBTA_HH_API_CONN)); + p_buf = (tBTA_HH_API_CONN *)osi_malloc(sizeof(tBTA_HH_API_CONN)); if (p_buf != NULL) { memset((void *)p_buf, 0, sizeof(tBTA_HH_API_CONN)); @@ -177,6 +177,8 @@ static void bta_hh_snd_write_dev(UINT8 dev_handle, UINT8 t_type, UINT8 param, p_buf->rpt_id = rpt_id; bta_sys_sendmsg(p_buf); + } else { + utl_freebuf((void **)&p_data); } } /******************************************************************************* @@ -299,6 +301,10 @@ void BTA_HhSendCtrl(UINT8 dev_handle, tBTA_HH_TRANS_CTRL_TYPE c_type) void BTA_HhSendData(UINT8 dev_handle, BD_ADDR dev_bda, BT_HDR *p_data) { UNUSED(dev_bda); + if (p_data == NULL) { + APPL_TRACE_ERROR("ERROR! Invalid parameter!"); + return; + } #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE) if (p_data->layer_specific != BTA_HH_RPTT_OUTPUT) { APPL_TRACE_ERROR("ERROR! Wrong report type! Write Command only valid for output report!"); @@ -321,7 +327,7 @@ void BTA_HhGetDscpInfo(UINT8 dev_handle) { BT_HDR *p_buf; - if ((p_buf = (BT_HDR *)osi_malloc((UINT16)sizeof(BT_HDR))) != NULL) { + if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR))) != NULL) { memset(p_buf, 0, sizeof(BT_HDR)); p_buf->event = BTA_HH_API_GET_DSCP_EVT; p_buf->layer_specific = (UINT16) dev_handle; @@ -336,7 +342,7 @@ void BTA_HhGetDscpInfo(UINT8 dev_handle) ** ** Description Add a virtually cabled device into HID-Host device list ** to manage and assign a device handle for future API call, -** host applciation call this API at start-up to initialize its +** host application call this API at start-up to initialize its ** virtually cabled devices. ** ** Returns void @@ -351,7 +357,7 @@ void BTA_HhAddDev(BD_ADDR bda, tBTA_HH_ATTR_MASK attr_mask, UINT8 sub_class, p_buf = (tBTA_HH_MAINT_DEV *)osi_malloc(len); if (p_buf != NULL) { - memset(p_buf, 0, sizeof(tBTA_HH_MAINT_DEV)); + memset(p_buf, 0, len); p_buf->hdr.event = BTA_HH_API_MAINT_DEV_EVT; p_buf->sub_event = BTA_HH_ADD_DEV_EVT; @@ -388,7 +394,7 @@ void BTA_HhRemoveDev(UINT8 dev_handle ) { tBTA_HH_MAINT_DEV *p_buf; - p_buf = (tBTA_HH_MAINT_DEV *)osi_malloc((UINT16)sizeof(tBTA_HH_MAINT_DEV)); + p_buf = (tBTA_HH_MAINT_DEV *)osi_malloc(sizeof(tBTA_HH_MAINT_DEV)); if (p_buf != NULL) { memset(p_buf, 0, sizeof(tBTA_HH_MAINT_DEV)); @@ -416,7 +422,7 @@ void BTA_HhUpdateLeScanParam(UINT8 dev_handle, UINT16 scan_int, UINT16 scan_win) { tBTA_HH_SCPP_UPDATE *p_buf; - p_buf = (tBTA_HH_SCPP_UPDATE *)osi_malloc((UINT16)sizeof(tBTA_HH_SCPP_UPDATE)); + p_buf = (tBTA_HH_SCPP_UPDATE *)osi_malloc(sizeof(tBTA_HH_SCPP_UPDATE)); if (p_buf != NULL) { memset(p_buf, 0, sizeof(tBTA_HH_SCPP_UPDATE)); @@ -452,7 +458,7 @@ void BTA_HhParseBootRpt(tBTA_HH_BOOT_RPT *p_data, UINT8 *p_report, { p_data->dev_type = BTA_HH_DEVT_UNKNOWN; - if (p_report) { + if (p_report && (report_len > 0)) { /* first byte is report ID */ switch (p_report[0]) { case BTA_HH_KEYBD_RPT_ID: /* key board report ID */ @@ -466,7 +472,7 @@ void BTA_HhParseBootRpt(tBTA_HH_BOOT_RPT *p_data, UINT8 *p_report, break; default: - APPL_TRACE_DEBUG("Unknown boot report: %d", p_report[0]);; + APPL_TRACE_DEBUG("Unknown boot report: %d", p_report[0]); break; } } diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_cfg.c b/components/bt/host/bluedroid/bta/hh/bta_hh_cfg.c index 383f23262c6..2b79529e1f2 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_cfg.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_cfg.c @@ -40,7 +40,7 @@ /* The type of devices supported by BTA HH and corresponding application ID */ -tBTA_HH_SPT_TOD p_devt_list[BTA_HH_MAX_DEVT_SPT] = { +static const tBTA_HH_SPT_TOD p_devt_list[BTA_HH_MAX_DEVT_SPT] = { {BTA_HH_DEVT_MIC, BTA_HH_APP_ID_MI}, {BTA_HH_DEVT_KBD, BTA_HH_APP_ID_KB}, {BTA_HH_DEVT_KBD | BTA_HH_DEVT_MIC, BTA_HH_APP_ID_KB}, @@ -53,7 +53,7 @@ tBTA_HH_SPT_TOD p_devt_list[BTA_HH_MAX_DEVT_SPT] = { }; -const tBTA_HH_CFG bta_hh_cfg = { +static const tBTA_HH_CFG bta_hh_cfg = { BTA_HH_MAX_DEVT_SPT, /* number of supported type of devices */ p_devt_list, /* ToD & AppID list */ BTA_HH_DISC_BUF_SIZE /* HH SDP discovery database size */ diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_main.c b/components/bt/host/bluedroid/bta/hh/bta_hh_main.c index 19f1045b1b8..48c25c3eacc 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_main.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_main.c @@ -115,116 +115,116 @@ const tBTA_HH_ACTION bta_hh_action[] = { /* state table for idle state */ const UINT8 bta_hh_st_idle[][BTA_HH_NUM_COLS] = { - /* Event Action Next state */ - /* BTA_HH_API_OPEN_EVT */ {BTA_HH_START_SDP, BTA_HH_W4_CONN_ST }, - /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_W4_CONN_ST }, - /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_CLOSE_ACT, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_DATA_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_IDLE_ST }, - /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_OPEN_CMPL_ACT, BTA_HH_CONN_ST } + /* Event Action Next state */ + /* BTA_HH_API_OPEN_EVT */ {BTA_HH_START_SDP, BTA_HH_W4_CONN_ST }, + /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_W4_CONN_ST }, + /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_CLOSE_ACT, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_DATA_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_IDLE_ST }, + /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_OPEN_CMPL_ACT, BTA_HH_CONN_ST }, #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE) - /* BTA_HH_GATT_CLOSE_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* BTA_HH_GATT_OPEN_EVT */ , {BTA_HH_GATT_OPEN, BTA_HH_W4_CONN_ST } - /* BTA_HH_START_ENC_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* BTA_HH_ENC_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* READ_CHAR_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* BTA_HH_GATT_WRITE_CMPL_EVT*/ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* READ_DESCR_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* WRITE_DESCR_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* SCPP_UPDATE_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } - /* BTA_HH_GATT_ENC_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_IDLE_ST } + /* BTA_HH_GATT_CLOSE_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_GATT_OPEN_EVT */ {BTA_HH_GATT_OPEN, BTA_HH_W4_CONN_ST }, + /* BTA_HH_START_ENC_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_ENC_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* READ_CHAR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_GATT_WRITE_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* READ_DESCR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* WRITE_DESCR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* SCPP_UPDATE_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_GATT_ENC_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, #endif }; const UINT8 bta_hh_st_w4_conn[][BTA_HH_NUM_COLS] = { - /* Event Action Next state */ - /* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, - /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_W4_CONN_ST }, - /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_OPEN_FAILURE, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_DATA_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, - /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, - /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, - /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_SDP_CMPL, BTA_HH_W4_CONN_ST }, - /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_WRITE_DEV_ACT, BTA_HH_W4_CONN_ST }, - /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, - /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_IDLE_ST }, - /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_OPEN_CMPL_ACT, BTA_HH_CONN_ST } + /* Event Action Next state */ + /* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_IGNORE, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_W4_CONN_ST }, + /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_OPEN_FAILURE, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_DATA_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_SDP_CMPL, BTA_HH_W4_CONN_ST }, + /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_WRITE_DEV_ACT, BTA_HH_W4_CONN_ST }, + /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_IDLE_ST }, + /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_OPEN_CMPL_ACT, BTA_HH_CONN_ST }, #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE) - /* BTA_HH_GATT_CLOSE_EVT */ , {BTA_HH_LE_OPEN_FAIL, BTA_HH_IDLE_ST } - /* BTA_HH_GATT_OPEN_EVT */ , {BTA_HH_GATT_OPEN, BTA_HH_W4_CONN_ST } - /* BTA_HH_START_ENC_EVT */ , {BTA_HH_START_SEC, BTA_HH_W4_SEC } - /* BTA_HH_ENC_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST } - /* READ_CHAR_CMPL_EVT */ , {BTA_HH_W4_LE_READ_CHAR, BTA_HH_W4_CONN_ST } - /* BTA_HH_GATT_WRITE_CMPL_EVT*/ , {BTA_HH_W4_LE_WRITE, BTA_HH_W4_CONN_ST } - /* READ_DESCR_CMPL_EVT */ , {BTA_HH_W4_LE_READ_DESCR, BTA_HH_W4_CONN_ST } - /* WRITE_DESCR_CMPL_EVT */ , {BTA_HH_WRITE_DESCR, BTA_HH_W4_CONN_ST } - /* SCPP_UPDATE_EVT */ , {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST } - /* BTA_HH_GATT_ENC_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST } + /* BTA_HH_GATT_CLOSE_EVT */ {BTA_HH_LE_OPEN_FAIL, BTA_HH_IDLE_ST }, + /* BTA_HH_GATT_OPEN_EVT */ {BTA_HH_GATT_OPEN, BTA_HH_W4_CONN_ST }, + /* BTA_HH_START_ENC_EVT */ {BTA_HH_START_SEC, BTA_HH_W4_SEC }, + /* BTA_HH_ENC_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* READ_CHAR_CMPL_EVT */ {BTA_HH_W4_LE_READ_CHAR, BTA_HH_W4_CONN_ST }, + /* BTA_HH_GATT_WRITE_CMPL_EVT */ {BTA_HH_W4_LE_WRITE, BTA_HH_W4_CONN_ST }, + /* READ_DESCR_CMPL_EVT */ {BTA_HH_W4_LE_READ_DESCR, BTA_HH_W4_CONN_ST }, + /* WRITE_DESCR_CMPL_EVT */ {BTA_HH_WRITE_DESCR, BTA_HH_W4_CONN_ST }, + /* SCPP_UPDATE_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, + /* BTA_HH_GATT_ENC_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_CONN_ST }, #endif }; const UINT8 bta_hh_st_connected[][BTA_HH_NUM_COLS] = { - /* Event Action Next state */ - /* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, - /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_API_DISC_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_CLOSE_ACT, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_DATA_EVT */ {BTA_HH_DATA_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_CTRL_DAT_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_HANDSK_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, - /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_WRITE_DEV_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_GET_DSCP_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_CONN_ST }, - /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST } + /* Event Action Next state */ + /* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, + /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_API_DISC_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_CLOSE_ACT, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_DATA_EVT */ {BTA_HH_DATA_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_CTRL_DAT_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_HANDSK_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, + /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_WRITE_DEV_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_GET_DSCP_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_CONN_ST }, + /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE) - /* BTA_HH_GATT_CLOSE_EVT */ , {BTA_HH_GATT_CLOSE, BTA_HH_IDLE_ST } - /* BTA_HH_GATT_OPEN_EVT */ , {BTA_HH_IGNORE, BTA_HH_CONN_ST } - /* BTA_HH_START_ENC_EVT */ , {BTA_HH_IGNORE, BTA_HH_CONN_ST } - /* BTA_HH_ENC_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_CONN_ST } - /* READ_CHAR_CMPL_EVT */ , {BTA_HH_LE_READ_CHAR, BTA_HH_CONN_ST } - /* WRITE_CHAR_CMPL_EVT*/ , {BTA_HH_LE_WRITE, BTA_HH_CONN_ST } - /* READ_DESCR_CMPL_EVT */ , {BTA_HH_LE_READ_DESCR, BTA_HH_CONN_ST } /* do not currently read any descr when connection up */ - /* WRITE_DESCR_CMPL_EVT */ , {BTA_HH_WRITE_DESCR, BTA_HH_CONN_ST } /* do not currently write any descr when connection up */ - /* SCPP_UPDATE_EVT */ , {BTA_HH_LE_UPDATE_SCPP, BTA_HH_CONN_ST } - /* BTA_HH_GATT_ENC_CMPL_EVT */ , {BTA_HH_IGNORE, BTA_HH_CONN_ST } + /* BTA_HH_GATT_CLOSE_EVT */ {BTA_HH_GATT_CLOSE, BTA_HH_IDLE_ST }, + /* BTA_HH_GATT_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, + /* BTA_HH_START_ENC_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, + /* BTA_HH_ENC_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, + /* READ_CHAR_CMPL_EVT */ {BTA_HH_LE_READ_CHAR, BTA_HH_CONN_ST }, + /* WRITE_CHAR_CMPL_EVT */ {BTA_HH_LE_WRITE, BTA_HH_CONN_ST }, + /* READ_DESCR_CMPL_EVT */ {BTA_HH_LE_READ_DESCR, BTA_HH_CONN_ST }, /* do not currently read any descr when connection up */ + /* WRITE_DESCR_CMPL_EVT */ {BTA_HH_WRITE_DESCR, BTA_HH_CONN_ST }, /* do not currently write any descr when connection up */ + /* SCPP_UPDATE_EVT */ {BTA_HH_LE_UPDATE_SCPP, BTA_HH_CONN_ST }, + /* BTA_HH_GATT_ENC_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }, #endif }; #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE) const UINT8 bta_hh_st_w4_sec[][BTA_HH_NUM_COLS] = { - /* Event Action Next state */ - /* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_API_DISC_ACT, BTA_HH_W4_SEC }, - /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_OPEN_FAILURE, BTA_HH_IDLE_ST }, - /* BTA_HH_INT_DATA_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_IGNORE , BTA_HH_W4_SEC }, - /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_W4_SEC }, - /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_GATT_CLOSE_EVT */ {BTA_HH_LE_OPEN_FAIL, BTA_HH_IDLE_ST }, - /* BTA_HH_GATT_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_START_ENC_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_ENC_CMPL_EVT */ {BTA_HH_SEC_CMPL, BTA_HH_W4_CONN_ST }, - /* READ_CHAR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* BTA_HH_GATT_WRITE_CMPL_EVT*/ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* READ_DESCR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, - /* WRITE_DESCR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC } - /* SCPP_UPDATE_EVT */ , {BTA_HH_IGNORE, BTA_HH_W4_SEC } - /* BTA_HH_GATT_ENC_CMPL_EVT */ , {BTA_HH_GATT_ENC_CMPL, BTA_HH_W4_SEC } + /* Event Action Next state */ + /* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_API_CLOSE_EVT */ {BTA_HH_API_DISC_ACT, BTA_HH_W4_SEC }, + /* BTA_HH_INT_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_OPEN_FAILURE, BTA_HH_IDLE_ST }, + /* BTA_HH_INT_DATA_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_INT_CTRL_DATA */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_IGNORE , BTA_HH_W4_SEC }, + /* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_W4_SEC }, + /* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_GATT_CLOSE_EVT */ {BTA_HH_LE_OPEN_FAIL, BTA_HH_IDLE_ST }, + /* BTA_HH_GATT_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_START_ENC_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_ENC_CMPL_EVT */ {BTA_HH_SEC_CMPL, BTA_HH_W4_CONN_ST }, + /* READ_CHAR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_GATT_WRITE_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* READ_DESCR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* WRITE_DESCR_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* SCPP_UPDATE_EVT */ {BTA_HH_IGNORE, BTA_HH_W4_SEC }, + /* BTA_HH_GATT_ENC_CMPL_EVT */ {BTA_HH_GATT_ENC_CMPL, BTA_HH_W4_SEC }, }; #endif @@ -337,7 +337,7 @@ void bta_hh_sm_execute(tBTA_HH_DEV_CB *p_cb, UINT16 event, tBTA_HH_DATA *p_data) cback_event = BTA_HH_CLOSE_EVT; cback_data.dev_status.status = BTA_HH_ERR_HDL; - cback_data.dev_status.handle = (UINT8)p_data->api_sndcmd.hdr.layer_specific; + cback_data.dev_status.handle = (UINT8)p_data->hdr.layer_specific; break; default: diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c b/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c index 7c89ed004d7..6650e404c65 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_utils.c @@ -38,9 +38,6 @@ #define BTA_HH_KB_CAPS_LOCK 0x39 /* caps lock */ #define BTA_HH_KB_NUM_LOCK 0x53 /* num lock */ - -#define BTA_HH_MAX_RPT_CHARS 8 - static const UINT8 bta_hh_mod_key_mask[BTA_HH_MOD_MAX_KEY] = { BTA_HH_KB_CTRL_MASK, BTA_HH_KB_SHIFT_MASK, @@ -119,6 +116,10 @@ void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB *p_cb) { UINT8 index; + if (!p_cb) { + return; + } + if (p_cb->hid_handle != BTA_HH_INVALID_HANDLE ) { #if BTA_HH_LE_INCLUDED == TRUE if (p_cb->is_le_device) { @@ -287,10 +288,6 @@ void bta_hh_parse_keybd_rpt(tBTA_HH_BOOT_RPT *p_kb_data, UINT8 *p_report, ctl_shift = *p_report++; report_len--; - if (report_len > BTA_HH_MAX_RPT_CHARS) { - report_len = BTA_HH_MAX_RPT_CHARS; - } - memset (this_report, 0, BTA_HH_MAX_RPT_CHARS); memset (p_data, 0, sizeof(tBTA_HH_KEYBD_RPT)); memcpy (this_report, p_report, report_len); @@ -332,7 +329,7 @@ void bta_hh_parse_keybd_rpt(tBTA_HH_BOOT_RPT *p_kb_data, UINT8 *p_report, p_kb->caps_lock = p_kb->caps_lock ? FALSE : TRUE; } else if (this_report[xx] == BTA_HH_KB_NUM_LOCK) { p_kb->num_lock = p_kb->num_lock ? FALSE : TRUE; - } else { + } else if (key_idx < BTA_HH_KB_VKEY_LEN) { p_data->this_char[key_idx ++] = this_char; } @@ -369,7 +366,7 @@ void bta_hh_parse_mice_rpt(tBTA_HH_BOOT_RPT *p_mice_data, UINT8 *p_report, report_len=%d) called", p_report, report_len); #endif - if (report_len < 3) { + if ((report_len < 3) || (p_report == NULL)) { return; } @@ -417,6 +414,7 @@ tBTA_HH_STATUS bta_hh_read_ssr_param(BD_ADDR bd_addr, UINT16 *p_max_ssr_lat, UIN tBTA_HH_CB *p_cb = &bta_hh_cb; UINT8 i; UINT16 ssr_max_latency; + for (i = 0; i < BTA_HH_MAX_KNOWN; i ++) { if (memcmp(p_cb->kdev[i].addr, bd_addr, BD_ADDR_LEN) == 0) { @@ -434,19 +432,26 @@ tBTA_HH_STATUS bta_hh_read_ssr_param(BD_ADDR bd_addr, UINT16 *p_max_ssr_lat, UIN ssr_max_latency = BTA_HH_SSR_MAX_LATENCY_DEF; } - * p_max_ssr_lat = ssr_max_latency; + if (p_max_ssr_lat) { + *p_max_ssr_lat = ssr_max_latency; + } } else { - * p_max_ssr_lat = p_cb->kdev[i].dscp_info.ssr_max_latency; + if (p_max_ssr_lat) { + *p_max_ssr_lat = p_cb->kdev[i].dscp_info.ssr_max_latency; + } } if (p_cb->kdev[i].dscp_info.ssr_min_tout == HID_SSR_PARAM_INVALID) { - * p_min_ssr_tout = BTA_HH_SSR_MIN_TOUT_DEF; + if (p_min_ssr_tout) { + *p_min_ssr_tout = BTA_HH_SSR_MIN_TOUT_DEF; + } } else { - * p_min_ssr_tout = p_cb->kdev[i].dscp_info.ssr_min_tout; + if (p_min_ssr_tout) { + *p_min_ssr_tout = p_cb->kdev[i].dscp_info.ssr_min_tout; + } } - status = BTA_HH_OK; - + status = BTA_HH_OK; break; } } @@ -540,4 +545,4 @@ void bta_hh_trace_dev_db(void) APPL_TRACE_DEBUG("*********************************************************"); } #endif -#endif /* HL_INCLUDED */ +#endif /* BTA_HH_INCLUDED */ diff --git a/components/bt/host/bluedroid/bta/include/bta/bta_hh_api.h b/components/bt/host/bluedroid/bta/include/bta/bta_hh_api.h index 88cd1926270..13fb0f031af 100644 --- a/components/bt/host/bluedroid/bta/include/bta/bta_hh_api.h +++ b/components/bt/host/bluedroid/bta/include/bta/bta_hh_api.h @@ -58,7 +58,7 @@ #define BTA_HH_VC_UNPLUG_EVT 13 /* virtually unplugged */ #define BTA_HH_DATA_EVT 15 #define BTA_HH_API_ERR_EVT 16 /* API error is caught */ -#define BTA_HH_UPDATE_SCPP_EVT 17 /* update scan paramter complete */ +#define BTA_HH_UPDATE_SCPP_EVT 17 /* update scan parameter complete */ #define BTA_HH_DATA_IND_EVT 18 /* Data on interrupt channel */ typedef UINT16 tBTA_HH_EVT; @@ -120,7 +120,7 @@ enum { BTA_HH_HS_HID_NOT_READY, /* handshake error : device not ready */ BTA_HH_HS_INVALID_RPT_ID, /* handshake error : invalid report ID */ BTA_HH_HS_TRANS_NOT_SPT, /* handshake error : transaction not spt */ - BTA_HH_HS_INVALID_PARAM, /* handshake error : invalid paremter */ + BTA_HH_HS_INVALID_PARAM, /* handshake error : invalid parameter */ BTA_HH_HS_ERROR, /* handshake error : unspecified HS error */ BTA_HH_ERR, /* general BTA HH error */ BTA_HH_ERR_SDP, /* SDP error */ @@ -156,9 +156,9 @@ typedef struct { /* configuration struct */ typedef struct { - UINT8 max_devt_spt; /* max number of types of devices spt */ - tBTA_HH_SPT_TOD *p_devt_list; /* supported types of device list */ - UINT16 sdp_db_size; + UINT8 max_devt_spt; /* max number of types of devices spt */ + const tBTA_HH_SPT_TOD *p_devt_list; /* supported types of device list */ + UINT16 sdp_db_size; } tBTA_HH_CFG; enum { @@ -237,7 +237,8 @@ enum { /* parsed boot mode keyboard report */ typedef struct { - UINT8 this_char[6]; /* virtual key code */ +#define BTA_HH_KB_VKEY_LEN (6) + UINT8 this_char[BTA_HH_KB_VKEY_LEN]; /* virtual key code */ BOOLEAN mod_key[BTA_HH_MOD_MAX_KEY]; /* ctrl, shift, Alt, GUI */ /* modifier key: is Shift key pressed */ @@ -500,7 +501,7 @@ extern void BTA_HhGetDscpInfo(UINT8 dev_handle); ** ** Description Add a virtually cabled device into HID-Host device list ** to manage and assign a device handle for future API call, -** host applciation call this API at start-up to initialize its +** host application call this API at start-up to initialize its ** virtually cabled devices. ** ** Returns void diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_act.c b/components/bt/host/bluedroid/bta/jv/bta_jv_act.c index bf0d91545b4..78fc08b04d1 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_act.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_act.c @@ -24,6 +24,7 @@ #include #include +#include #include "osi/allocator.h" #include "osi/osi.h" @@ -37,9 +38,7 @@ #include "stack/btm_api.h" #include "btm_int.h" #include "stack/sdp_api.h" -#include "stack/l2c_api.h" #include "stack/port_api.h" -#include #include "stack/rfcdefs.h" #include "stack/avct_api.h" #include "stack/avdt_api.h" @@ -288,8 +287,7 @@ tBTA_JV_RFC_CB *bta_jv_rfc_port_to_cb(UINT16 port_handle) p_cb = &bta_jv_cb.rfc_cb[handle - 1]; } } else { - APPL_TRACE_WARNING("bta_jv_rfc_port_to_cb(port_handle:0x%x):jv handle:0x%x not" - " FOUND", port_handle, bta_jv_cb.port_cb[port_handle - 1].handle); + APPL_TRACE_WARNING("bta_jv_rfc_port_to_cb(port_handle:0x%x)", port_handle); } return p_cb; } @@ -302,7 +300,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc UINT8 used = 0, i, listen = 0; tPORT_STATE port_state; UINT32 event_mask = BTA_JV_RFC_EV_MASK; - UINT32 scn_num = (UINT32)p_cb->scn; + UINT32 scn_num = 0; tBTA_JV evt_data = {0}; if (!p_cb || !p_pcb) { @@ -424,6 +422,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc evt_data.rfc_srv_open.handle = 0; evt_data.rfc_srv_open.new_listen_handle = p_pcb->handle; evt_data.rfc_srv_open.status = BTA_JV_SUCCESS; + scn_num = (UINT32)p_cb->scn; p_pcb->user_data = p_cb->p_cback(BTA_JV_RFCOMM_SRV_OPEN_EVT, &evt_data, (void *)scn_num); } } @@ -510,9 +509,12 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle) int i, j, bd_counter = 0, appid_counter = 0; for (i = 0; i < BTA_JV_PM_MAX_NUM; i++) { - p_cb = NULL; if ((bta_jv_cb.pm_cb[i].state != BTA_JV_PM_FREE_ST) && (jv_handle == bta_jv_cb.pm_cb[i].handle)) { + p_cb = NULL; + bd_counter = 0; + appid_counter = 0; + for (j = 0; j < BTA_JV_PM_MAX_NUM; j++) { if (bdcmp(bta_jv_cb.pm_cb[j].peer_bd_addr, bta_jv_cb.pm_cb[i].peer_bd_addr) == 0) { bd_counter++; @@ -722,11 +724,12 @@ BOOLEAN bta_jv_check_psm(UINT16 psm) void bta_jv_enable(tBTA_JV_MSG *p_data) { tBTA_UTL_COD cod; - tBTA_JV_STATUS status = BTA_JV_SUCCESS; + + memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list)); + bta_jv_cb.p_dm_cback = p_data->enable.p_cback; bta_jv_cb.p_dm_cback(BTA_JV_ENABLE_EVT, (tBTA_JV *)&status, 0); - memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list)); /* Set the Class of Device */ cod.major = BTM_COD_MAJOR_UNCLASSIFIED; @@ -993,8 +996,11 @@ static void bta_jv_start_discovery_cback(UINT16 result, void *user_data) } else { dcomp.service_name[dcomp.scn_num] = NULL; } - dcomp.scn_num++; status = BTA_JV_SUCCESS; + dcomp.scn_num++; + if (dcomp.scn_num == BTA_JV_MAX_SCN) { + break; + } } } while (p_sdp_rec); } @@ -1742,7 +1748,7 @@ static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle, void* dat void *user_data = NULL; APPL_TRACE_DEBUG( "bta_jv_port_mgmt_cl_cback:code:%d, port_handle%d", code, port_handle); - if (NULL == p_cb || NULL == p_cb->p_cback) { + if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) { return; } @@ -2019,7 +2025,7 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat int failed = TRUE; // APPL_TRACE_DEBUG("bta_jv_port_mgmt_sr_cback, code:0x%x, port_handle:%d", code, (uint16_t)port_handle); - if (NULL == p_cb || NULL == p_cb->p_cback) { + if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) { // APPL_TRACE_ERROR("bta_jv_port_mgmt_sr_cback, p_cb:%p, p_cb->p_cback%p", // p_cb, p_cb ? p_cb->p_cback : NULL); return; @@ -2042,10 +2048,10 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat /* accept the connection defaulted */ if (p_mgmt_cb_arg) { p_mgmt_cb_arg->accept = TRUE; + evt_data.rfc_srv_open.peer_mtu = p_mgmt_cb_arg->peer_mtu; } evt_data.rfc_srv_open.handle = p_pcb->handle; evt_data.rfc_srv_open.status = BTA_JV_SUCCESS; - evt_data.rfc_srv_open.peer_mtu = p_mgmt_cb_arg->peer_mtu; bdcpy(evt_data.rfc_srv_open.rem_bda, rem_bda); tBTA_JV_PCB *p_pcb_new_listen = bta_jv_add_rfc_port(p_cb, p_pcb); if (p_pcb_new_listen) { @@ -2129,7 +2135,7 @@ static void bta_jv_port_event_sr_cback(UINT32 code, UINT16 port_handle) tBTA_JV_RFC_CB *p_cb = bta_jv_rfc_port_to_cb(port_handle); tBTA_JV evt_data = {0}; - if (NULL == p_cb || NULL == p_cb->p_cback) { + if (NULL == p_cb || NULL == p_cb->p_cback || NULL == p_pcb) { return; } @@ -2542,7 +2548,7 @@ static void bta_jv_pm_conn_busy(tBTA_JV_PM_CB *p_cb) /******************************************************************************* ** - ** Function bta_jv_pm_conn_busy + ** Function bta_jv_pm_conn_idle ** ** Description set pm connection busy state (input param safe) ** @@ -2860,6 +2866,7 @@ static void fcchan_conn_chng_cbk(UINT16 chan, BD_ADDR bd_addr, BOOLEAN connected open_evt.l2c_open.status = BTA_JV_SUCCESS; } else { fcclient_free(t); + t = NULL; open_evt.l2c_open.status = BTA_JV_FAILURE; } } @@ -2871,7 +2878,7 @@ static void fcchan_conn_chng_cbk(UINT16 chan, BD_ADDR bd_addr, BOOLEAN connected //call this with lock taken so socket does not disappear from under us */ if (p_cback) { p_cback(BTA_JV_L2CAP_OPEN_EVT, &open_evt, user_data); - if (!t->p_cback) { /* no callback set, means they do not want this one... */ + if (t && !t->p_cback) { /* no callback set, means they do not want this one... */ fcclient_free(t); } } @@ -2889,10 +2896,13 @@ static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf) tc = fcchan_get(chan, FALSE); if (tc) { t = fcclient_find_by_addr(tc->clients, bd_addr); // try to find an open socked for that addr and channel - if (!t) { - //no socket -> drop it - return; + } + if (!t) { + //no socket -> drop it + if (p_buf) { + osi_free(p_buf); } + return; } sock_cback = t->p_cback; diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_api.c b/components/bt/host/bluedroid/bta/jv/bta_jv_api.c index 79518e6917c..4909859772f 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_api.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_api.c @@ -35,7 +35,6 @@ #include "stack/gap_api.h" #include "common/bt_target.h" -#include "stack/sdp_api.h" #if (defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE) @@ -74,6 +73,14 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback) p_bta_jv_cfg->p_sdp_raw_data = (UINT8 *)osi_malloc(p_bta_jv_cfg->sdp_raw_size); p_bta_jv_cfg->p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_jv_cfg->sdp_db_size); if (p_bta_jv_cfg->p_sdp_raw_data == NULL || p_bta_jv_cfg->p_sdp_db == NULL) { + if (p_bta_jv_cfg->p_sdp_raw_data) { + osi_free(p_bta_jv_cfg->p_sdp_raw_data); + p_bta_jv_cfg->p_sdp_raw_data = NULL; + } + if (p_bta_jv_cfg->p_sdp_db) { + osi_free( p_bta_jv_cfg->p_sdp_db); + p_bta_jv_cfg->p_sdp_db = NULL; + } return BTA_JV_NO_DATA; } #endif @@ -287,7 +294,9 @@ tBTA_JV_STATUS BTA_JvStartDiscovery(BD_ADDR bd_addr, UINT16 num_uuid, p_msg->hdr.event = BTA_JV_API_START_DISCOVERY_EVT; bdcpy(p_msg->bd_addr, bd_addr); p_msg->num_uuid = num_uuid; - memcpy(p_msg->uuid_list, p_uuid_list, num_uuid * sizeof(tSDP_UUID)); + if (p_uuid_list && (num_uuid > 0)) { + memcpy(p_msg->uuid_list, p_uuid_list, num_uuid * sizeof(tSDP_UUID)); + } p_msg->num_attr = 0; p_msg->user_data = user_data; bta_sys_sendmsg(p_msg); @@ -318,7 +327,12 @@ tBTA_JV_STATUS BTA_JvCreateRecordByUser(const char *name, UINT32 channel, void * if ((p_msg = (tBTA_JV_API_CREATE_RECORD *)osi_malloc(sizeof(tBTA_JV_API_CREATE_RECORD))) != NULL) { p_msg->hdr.event = BTA_JV_API_CREATE_RECORD_EVT; p_msg->user_data = user_data; - strcpy(p_msg->name, name); + if (name) { + strncpy(p_msg->name, name, ESP_SDP_SERVER_NAME_MAX); + p_msg->name[ESP_SDP_SERVER_NAME_MAX] = '\0'; + } else { + p_msg->name[0] = '\0'; + } p_msg->channel = channel; bta_sys_sendmsg(p_msg); status = BTA_JV_SUCCESS; @@ -685,9 +699,7 @@ tBTA_JV_STATUS BTA_JvL2capStopServerLE(UINT16 local_chan, void *user_data) ** ** Function BTA_JvL2capRead ** -** Description This function reads data from an L2CAP connecti; - tBTA_JV_RFC_CB *p_cb = rc->p_cb; -on +** Description This function reads data from an L2CAP connection ** When the operation is complete, tBTA_JV_L2CAP_CBACK is ** called with BTA_JV_L2CAP_READ_EVT. ** @@ -1125,7 +1137,9 @@ tBTA_JV_STATUS BTA_JvRfcommReady(UINT32 handle, UINT32 *p_data_size) status = BTA_JV_SUCCESS; } } - *p_data_size = size; + if (p_data_size) { + *p_data_size = size; + } return (status); } diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c b/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c index 9ec4d77df06..257eccb31bd 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_cfg.c @@ -19,8 +19,7 @@ /****************************************************************************** * - * This file contains compile-time configurable constants for advanced - * audio + * This file contains compile-time configurable constants for Java I/F * ******************************************************************************/ @@ -49,7 +48,7 @@ static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE] #endif /* JV configuration structure */ -/*const */tBTA_JV_CFG bta_jv_cfg = { +tBTA_JV_CFG bta_jv_cfg = { BTA_JV_SDP_RAW_DATA_SIZE, /* The size of p_sdp_raw_data */ BTA_JV_SDP_DB_SIZE, /* The size of p_sdp_db_data */ #if BTA_DYNAMIC_MEMORY == FALSE @@ -61,7 +60,7 @@ static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE] #endif }; -tBTA_JV_CFG *p_bta_jv_cfg = (tBTA_JV_CFG *) &bta_jv_cfg; +tBTA_JV_CFG *p_bta_jv_cfg = &bta_jv_cfg; #endif ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_main.c b/components/bt/host/bluedroid/bta/jv/bta_jv_main.c index f233e933505..69324a8625a 100644 --- a/components/bt/host/bluedroid/bta/jv/bta_jv_main.c +++ b/components/bt/host/bluedroid/bta/jv/bta_jv_main.c @@ -95,6 +95,10 @@ const tBTA_JV_ACTION bta_jv_action[] = { *******************************************************************************/ BOOLEAN bta_jv_sm_execute(BT_HDR *p_msg) { + if (!p_msg) { + return FALSE; + } + BOOLEAN ret = FALSE; UINT16 action = (p_msg->event & 0x00ff); /* execute action functions */ diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp.c index 71773d984c6..101934550d6 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp.c @@ -18,7 +18,7 @@ /****************************************************************************** * - * This is the main implementation file for the BTA MCE I/F + * This is the main implementation file for the BTA SDP I/F * ******************************************************************************/ diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c index 045672f0dc5..b0b2ee13a3c 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c @@ -425,7 +425,10 @@ static void bta_sdp_search_cback(UINT16 result, void *user_data) bta_sdp_cb.sdp_active = BTA_SDP_ACTIVE_NONE; - if (bta_sdp_cb.p_dm_cback == NULL) { + if ((bta_sdp_cb.p_dm_cback == NULL) || (user_data == NULL)) { + if (user_data) { + osi_free(user_data); + } return; } @@ -517,12 +520,15 @@ void bta_sdp_enable(tBTA_SDP_MSG *p_data) void bta_sdp_search(tBTA_SDP_MSG *p_data) { int x = 0; - // TODO: Leaks!!! but needed as user-data pointer - tBT_UUID *bta_sdp_search_uuid = osi_malloc(sizeof(tBT_UUID)); if (p_data == NULL) { APPL_TRACE_DEBUG("SDP control block handle is null\n"); return; } + tBT_UUID *bta_sdp_search_uuid = osi_malloc(sizeof(tBT_UUID)); + if (bta_sdp_search_uuid == NULL) { + APPL_TRACE_DEBUG("SDP search param malloc failed\n"); + return; + } tBTA_SDP_STATUS status = BTA_SDP_FAILURE; APPL_TRACE_DEBUG("%s in, sdp_active:%d\n", __func__, bta_sdp_cb.sdp_active); @@ -537,6 +543,7 @@ void bta_sdp_search(tBTA_SDP_MSG *p_data) result.status = status; bta_sdp_cb.p_dm_cback(BTA_SDP_SEARCH_COMP_EVT, (tBTA_SDP *)&result, NULL); } + osi_free(bta_sdp_search_uuid); return; } @@ -560,6 +567,7 @@ void bta_sdp_search(tBTA_SDP_MSG *p_data) if (!SDP_ServiceSearchAttributeRequest2(p_data->get_search.bd_addr, p_bta_sdp_cfg->p_sdp_db, bta_sdp_search_cback, (void *)bta_sdp_search_uuid)) { + osi_free(bta_sdp_search_uuid); bta_sdp_cb.sdp_active = BTA_SDP_ACTIVE_NONE; /* failed to start SDP. report the failure right away */ @@ -620,7 +628,7 @@ void bta_sdp_remove_record(tBTA_SDP_MSG *p_data) ** ** Function bta_sdp_disable ** -** Description Removes an SDP record +** Description Disable SDP ** ** Returns void ** diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c index d46f784bf16..d670a5e33d1 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c @@ -62,6 +62,11 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback) APPL_TRACE_API("%s\n", __FUNCTION__); + /* do not allocate sdp_db / raw buffers unless we can run the enable path */ + if (p_cback == NULL || bta_sys_is_register(BTA_ID_SDP)) { + return BTA_SDP_FAILURE; + } + #if BTA_DYNAMIC_MEMORY == TRUE /* Malloc buffer for SDP configuration structure */ p_bta_sdp_cfg->p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_sdp_cfg->sdp_db_size); @@ -72,19 +77,20 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback) } #endif - if (p_cback && FALSE == bta_sys_is_register(BTA_ID_SDP)) { - memset(&bta_sdp_cb, 0, sizeof(tBTA_SDP_CB)); + memset(&bta_sdp_cb, 0, sizeof(tBTA_SDP_CB)); - /* register with BTA system manager */ + if ((p_buf = (tBTA_SDP_API_ENABLE *) osi_malloc(sizeof(tBTA_SDP_API_ENABLE))) != NULL) { + /* register with BTA system manager only after buffer alloc succeeds */ bta_sys_register(BTA_ID_SDP, &bta_sdp_reg); - - if (p_cback && - (p_buf = (tBTA_SDP_API_ENABLE *) osi_malloc(sizeof(tBTA_SDP_API_ENABLE))) != NULL) { - p_buf->hdr.event = BTA_SDP_API_ENABLE_EVT; - p_buf->p_cback = p_cback; - bta_sys_sendmsg(p_buf); - status = BTA_SDP_SUCCESS; - } + p_buf->hdr.event = BTA_SDP_API_ENABLE_EVT; + p_buf->p_cback = p_cback; + bta_sys_sendmsg(p_buf); + status = BTA_SDP_SUCCESS; + } else { +#if BTA_DYNAMIC_MEMORY == TRUE + /* undo sdp_db / sdp_raw_data from above; not registered yet */ + BTA_SdpCleanup(); +#endif } return (status); } @@ -104,12 +110,12 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback) tBTA_SDP_STATUS BTA_SdpDisable(void) { BT_HDR *p_buf = NULL; - tBTA_SDP_STATUS status = BTA_SDP_SUCCESS; + tBTA_SDP_STATUS status = BTA_SDP_FAILURE; if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR))) != NULL) { p_buf->event = BTA_SDP_API_DISABLE_EVT; bta_sys_sendmsg(p_buf); - status = BTA_SDP_FAILURE; + status = BTA_SDP_SUCCESS; } return status; @@ -151,6 +157,10 @@ tBTA_SDP_STATUS BTA_SdpSearch(BD_ADDR bd_addr, tSDP_UUID *uuid) tBTA_SDP_STATUS ret = BTA_SDP_FAILURE; tBTA_SDP_API_SEARCH *p_msg; + if (!uuid) { + return BTA_SDP_FAILURE; + } + APPL_TRACE_API("%s\n", __FUNCTION__); if ((p_msg = (tBTA_SDP_API_SEARCH *)osi_malloc(sizeof(tBTA_SDP_API_SEARCH))) != NULL) { p_msg->hdr.event = BTA_SDP_API_SEARCH_EVT; diff --git a/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c b/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c index 423905bc50b..6e213048917 100644 --- a/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c +++ b/components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c @@ -52,6 +52,6 @@ tBTA_SDP_CFG bta_sdp_cfg = { #endif }; -tBTA_SDP_CFG *p_bta_sdp_cfg = (tBTA_SDP_CFG *) &bta_sdp_cfg; +tBTA_SDP_CFG *p_bta_sdp_cfg = &bta_sdp_cfg; #endif /* #if defined(BTA_SDP_INCLUDED) && (BTA_SDP_INCLUDED == TRUE) */ diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c b/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c index e4c8ebd71c6..7dc955ffc39 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -11,9 +11,15 @@ #if (BTC_GAP_BT_INCLUDED == TRUE) void btc_gap_bt_config_eir_cmpl_callback (uint8_t status, uint8_t eir_type_num, uint8_t *eir_type) { - esp_bt_gap_cb_param_t param; + esp_bt_gap_cb_param_t param = {0}; + btc_msg_t msg = {0}; bt_status_t ret; - btc_msg_t msg; + + if (!eir_type || (eir_type_num > ESP_BT_EIR_TYPE_MAX_NUM)) { + BTC_TRACE_ERROR("%s invalid params", __func__); + return; + } + msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BT; msg.act = BTC_GAP_BT_CONFIG_EIR_DATA_EVT; @@ -26,7 +32,7 @@ void btc_gap_bt_config_eir_cmpl_callback (uint8_t status, uint8_t eir_type_num, sizeof(esp_bt_gap_cb_param_t), NULL, NULL); if (ret != BT_STATUS_SUCCESS) { - BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__); + BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__); } } #endif /// (BTC_GAP_BT_INCLUDED == TRUE) diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c index 9d22b7e4186..0bd3b0138f7 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c @@ -89,7 +89,6 @@ static void btc_bt_set_scan_mode(esp_bt_connection_mode_t c_mode, esp_bt_discove } BTA_DmSetVisibility(disc_mode, conn_mode, BTA_DM_IGNORE, BTA_DM_IGNORE); - return; } static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg) @@ -97,7 +96,7 @@ static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg) tBTA_DM_INQ inq_params; tBTA_SERVICE_MASK services = 0; - BTIF_TRACE_EVENT("%s", __FUNCTION__); + BTIF_TRACE_EVENT("%s", __func__); inq_params.mode = (arg->start_disc.mode == ESP_BT_INQ_MODE_GENERAL_INQUIRY) ? BTA_DM_GENERAL_INQUIRY : BTA_DM_LIMITED_INQUIRY; @@ -112,8 +111,6 @@ static void btc_gap_bt_start_discovery(btc_gap_bt_args_t *arg) gap_bt_local_param.disc_stat = ESP_BT_GAP_DISCOVERY_STOPPED; /* find nearby devices */ BTA_DmSearch(&inq_params, services, bte_search_devices_evt); - - return; } static void btc_gap_bt_cancel_discovery(void) @@ -1057,6 +1054,9 @@ static void btc_gap_bt_get_dev_name_callback(UINT8 status, char *name) ret = btc_transfer_context(&msg, ¶m, sizeof(esp_bt_gap_cb_param_t), NULL, NULL); if (ret != BT_STATUS_SUCCESS) { BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__); + if (param.get_dev_name_cmpl.name) { + osi_free(param.get_dev_name_cmpl.name); + } } } @@ -1339,7 +1339,6 @@ void btc_gap_bt_call_handler(btc_msg_t *msg) break; } btc_gap_bt_arg_deep_free(msg); - return; } void btc_gap_bt_busy_level_updated(uint8_t bl_flags) @@ -1395,10 +1394,16 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg) #if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE) case BTC_GAP_BT_SET_MIN_ENC_KEY_SIZE_EVT: #endif /// ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE - case BTC_GAP_BT_GET_DEV_NAME_CMPL_EVT: break; + case BTC_GAP_BT_GET_DEV_NAME_CMPL_EVT: { + char *name = ((esp_bt_gap_cb_param_t *)msg->arg)->get_dev_name_cmpl.name; + if (name) { + osi_free(name); + } + break; + } default: - BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act); + BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __func__, msg->act); break; } } @@ -1518,7 +1523,7 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg) break; } default: - BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act); + BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __func__, msg->act); break; } btc_gap_bt_cb_deep_free(msg); diff --git a/components/bt/host/bluedroid/btc/profile/std/hid/bta_hh_co.c b/components/bt/host/bluedroid/btc/profile/std/hid/bta_hh_co.c index 066c70b69d4..63daecafa64 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hid/bta_hh_co.c +++ b/components/bt/host/bluedroid/btc/profile/std/hid/bta_hh_co.c @@ -1,6 +1,6 @@ +#include #include "btc_hh.h" #include "osi/allocator.h" -#include "string.h" #if HID_HOST_INCLUDED == TRUE /******************************************************************************* @@ -12,9 +12,9 @@ * * Returns void. ******************************************************************************/ -void bta_hh_co_open(uint8_t dev_handle, uint8_t sub_class, tBTA_HH_ATTR_MASK attr_mask, uint8_t app_id) +void bta_hh_co_open(UINT8 dev_handle, UINT8 sub_class, tBTA_HH_ATTR_MASK attr_mask, UINT8 app_id) { - uint32_t i; + UINT32 i; btc_hh_device_t *p_dev = NULL; if (dev_handle == BTA_HH_INVALID_HANDLE) { @@ -73,9 +73,9 @@ void bta_hh_co_open(uint8_t dev_handle, uint8_t sub_class, tBTA_HH_ATTR_MASK att * * Returns void. ******************************************************************************/ -void bta_hh_co_close(uint8_t dev_handle, uint8_t app_id) +void bta_hh_co_close(UINT8 dev_handle, UINT8 app_id) { - uint32_t i; + UINT32 i; btc_hh_device_t *p_dev = NULL; APPL_TRACE_WARNING("%s: dev_handle = %d, app_id = %d", __func__, dev_handle, app_id); @@ -129,6 +129,10 @@ void bta_hh_co_data(UINT8 dev_handle, UINT8 *p_rpt, UINT16 len, tBTA_HH_PROTO_MO __func__, dev_handle, sub_class, mode, ctry_code, app_id); do { + if ((p_rpt == NULL) || (len == 0)) { + ret = BTA_HH_ERR; + break; + } if ((p_buf = osi_malloc(sizeof(BT_HDR) + len)) == NULL) { APPL_TRACE_ERROR("%s malloc failed!", __func__); ret = BTA_HH_ERR_NO_RES; diff --git a/components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c b/components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c index 5986943bfa4..4e23c7f8e31 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c +++ b/components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c @@ -28,6 +28,7 @@ #include #include +#include #include #include "bta/bta_api.h" @@ -46,13 +47,16 @@ #if HID_DEV_INCLUDED == TRUE #include "bta_dm_int.h" +_Static_assert(sizeof(tBTA_HD_QOS_INFO) == sizeof(esp_hidd_qos_param_t), + "QoS layout must match between BTA and esp_hidd"); + /* HD request events */ typedef enum { BTC_HD_DUMMY_REQ_EVT = 0 } btc_hd_req_evt_t; /******************************************************************************* * Static variables ******************************************************************************/ -btc_hd_cb_t btc_hd_cb = {0}; +static btc_hd_cb_t btc_hd_cb = {0}; // static tBTA_HD_APP_INFO app_info; // static tBTA_HD_QOS_INFO in_qos; @@ -64,7 +68,7 @@ btc_hd_cb_t btc_hd_cb = {0}; #define BTC_HD_APP_NAME_LEN 50 #define BTC_HD_APP_DESCRIPTION_LEN 50 #define BTC_HD_APP_PROVIDER_LEN 50 -#define BTC_HD_APP_DESCRIPTOR_LEN 2048 +#define BTC_HD_APP_DESCRIPTOR_LEN ESP_HIDD_APP_DESC_LIST_LEN_MAX #define COD_HID_KEYBOARD 0x0540 #define COD_HID_POINTING 0x0580 #define COD_HID_COMBO 0x05C0 @@ -79,9 +83,9 @@ static void btc_hd_cb_arg_deep_free(btc_msg_t *msg); static inline void btc_hd_cb_to_app(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param) { - esp_hd_cb_t btc_hd_cb = (esp_hd_cb_t)btc_profile_cb_get(BTC_PID_HD); - if (btc_hd_cb) { - btc_hd_cb(event, param); + esp_hd_cb_t btc_hd_cbk = (esp_hd_cb_t)btc_profile_cb_get(BTC_PID_HD); + if (btc_hd_cbk) { + btc_hd_cbk(event, param); } } @@ -174,13 +178,13 @@ static void bte_hd_evt(tBTA_HD_EVT event, tBTA_HD *p_data) param_len = sizeof(tBTA_HD_CONN); break; case BTA_HD_GET_REPORT_EVT: - param_len += sizeof(tBTA_HD_GET_REPORT); + param_len = sizeof(tBTA_HD_GET_REPORT); break; case BTA_HD_SET_REPORT_EVT: param_len = sizeof(tBTA_HD_SET_REPORT); break; case BTA_HD_SET_PROTOCOL_EVT: - param_len += sizeof(p_data->set_protocol); + param_len = sizeof(p_data->set_protocol); break; case BTA_HD_INTR_DATA_EVT: param_len = sizeof(tBTA_HD_INTR_DATA); @@ -262,7 +266,7 @@ static void btc_hd_deinit(void) break; } - btc_hd_cb.service_dereg_active = FALSE; + btc_hd_cb.service_dereg_active = false; // unregister app will also release the connection // and disable after receiving unregister event from lower layer if (is_hidd_app_register()) { @@ -296,6 +300,22 @@ static void btc_hd_register_app(esp_hidd_app_param_t *p_app_param, esp_hidd_qos_ BTC_TRACE_API("%s", __func__); esp_hidd_status_t ret = ESP_HIDD_SUCCESS; do { + if (!p_app_param || !p_in_qos || !p_out_qos) { + BTC_TRACE_ERROR("bad app_param(%p), in_qos(%p) or out_qos(%p)", p_app_param, p_in_qos, p_out_qos); + ret = ESP_HIDD_ERROR; + break; + } + if ((p_app_param->desc_list_len <= 0) || (p_app_param->desc_list_len > BTC_HD_APP_DESCRIPTOR_LEN) || !p_app_param->desc_list) { + BTC_TRACE_ERROR("bad desc_list_len (%d) or desc_list(%p)", p_app_param->desc_list_len, p_app_param->desc_list); + ret = ESP_HIDD_ERROR; + break; + } + if (!p_app_param->name || !p_app_param->description || !p_app_param->provider) { + BTC_TRACE_ERROR("bad name(%p), description(%p) or provider(%p)", p_app_param->name, p_app_param->description, p_app_param->provider); + ret = ESP_HIDD_ERROR; + break; + } + if (!is_hidd_init()) { BTC_TRACE_ERROR("%s HD has not been initiated, shall init first!", __func__); ret = ESP_HIDD_NEED_INIT; @@ -312,10 +332,15 @@ static void btc_hd_register_app(esp_hidd_app_param_t *p_app_param, esp_hidd_qos_ break; } - if ((btc_hd_cb.app_info.p_name = (char *)osi_malloc(BTC_HD_APP_NAME_LEN)) == NULL || - (btc_hd_cb.app_info.p_description = (char *)osi_malloc(BTC_HD_APP_DESCRIPTION_LEN)) == NULL || - (btc_hd_cb.app_info.p_provider = (char *)osi_malloc(BTC_HD_APP_PROVIDER_LEN)) == NULL || - (btc_hd_cb.app_info.descriptor.dsc_list = (uint8_t *)osi_malloc(p_app_param->desc_list_len)) == NULL) { + size_t name_len = strnlen(p_app_param->name, BTC_HD_APP_NAME_LEN); + size_t description_len = strnlen(p_app_param->description, BTC_HD_APP_DESCRIPTION_LEN); + size_t provider_len = strnlen(p_app_param->provider, BTC_HD_APP_PROVIDER_LEN); + size_t desc_list_len = (size_t)p_app_param->desc_list_len; + + if ((btc_hd_cb.app_info.p_name = (char *)osi_malloc(name_len + 1)) == NULL || + (btc_hd_cb.app_info.p_description = (char *)osi_malloc(description_len + 1)) == NULL || + (btc_hd_cb.app_info.p_provider = (char *)osi_malloc(provider_len + 1)) == NULL || + (btc_hd_cb.app_info.descriptor.dsc_list = (uint8_t *)osi_malloc(desc_list_len)) == NULL) { BTC_TRACE_ERROR( "%s malloc app_info failed! p_name:%p, p_description:%p, p_provider:%p, descriptor.dsc_list:%p", __func__, btc_hd_cb.app_info.p_name, btc_hd_cb.app_info.p_description, btc_hd_cb.app_info.p_provider, @@ -323,25 +348,18 @@ static void btc_hd_register_app(esp_hidd_app_param_t *p_app_param, esp_hidd_qos_ ret = ESP_HIDD_NO_RES; break; } - memcpy(btc_hd_cb.app_info.p_name, p_app_param->name, BTC_HD_APP_NAME_LEN); - memcpy(btc_hd_cb.app_info.p_description, p_app_param->description, BTC_HD_APP_DESCRIPTION_LEN); - memcpy(btc_hd_cb.app_info.p_provider, p_app_param->provider, BTC_HD_APP_PROVIDER_LEN); - memcpy(btc_hd_cb.app_info.descriptor.dsc_list, p_app_param->desc_list, p_app_param->desc_list_len); + memcpy(btc_hd_cb.app_info.p_name, p_app_param->name, name_len); + btc_hd_cb.app_info.p_name[name_len] = '\0'; + memcpy(btc_hd_cb.app_info.p_description, p_app_param->description, description_len); + btc_hd_cb.app_info.p_description[description_len] = '\0'; + memcpy(btc_hd_cb.app_info.p_provider, p_app_param->provider, provider_len); + btc_hd_cb.app_info.p_provider[provider_len] = '\0'; + memcpy(btc_hd_cb.app_info.descriptor.dsc_list, p_app_param->desc_list, desc_list_len); btc_hd_cb.app_info.subclass = p_app_param->subclass; btc_hd_cb.app_info.descriptor.dl_len = p_app_param->desc_list_len; - btc_hd_cb.in_qos.service_type = p_in_qos->service_type; - btc_hd_cb.in_qos.token_rate = p_in_qos->token_rate; - btc_hd_cb.in_qos.token_bucket_size = p_in_qos->token_bucket_size; - btc_hd_cb.in_qos.peak_bandwidth = p_in_qos->peak_bandwidth; - btc_hd_cb.in_qos.access_latency = p_in_qos->access_latency; - btc_hd_cb.in_qos.delay_variation = p_in_qos->delay_variation; - btc_hd_cb.out_qos.service_type = p_out_qos->service_type; - btc_hd_cb.out_qos.token_rate = p_out_qos->token_rate; - btc_hd_cb.out_qos.token_bucket_size = p_out_qos->token_bucket_size; - btc_hd_cb.out_qos.peak_bandwidth = p_out_qos->peak_bandwidth; - btc_hd_cb.out_qos.access_latency = p_out_qos->access_latency; - btc_hd_cb.out_qos.delay_variation = p_out_qos->delay_variation; + memcpy(&btc_hd_cb.in_qos, p_in_qos, sizeof(tBTA_HD_QOS_INFO)); + memcpy(&btc_hd_cb.out_qos, p_out_qos, sizeof(tBTA_HD_QOS_INFO)); BTA_HdRegisterApp(&btc_hd_cb.app_info, &btc_hd_cb.in_qos, &btc_hd_cb.out_qos); } while(0); @@ -391,7 +409,7 @@ static void btc_hd_unregister_app(bool need_deinit) ret = ESP_HIDD_BUSY; break; } - btc_hd_cb.service_dereg_active = TRUE; + btc_hd_cb.service_dereg_active = true; if (need_deinit) { btc_hd_cb.status = BTC_HD_DISABLING; @@ -583,10 +601,10 @@ static void btc_hd_send_report(esp_hidd_report_type_t type, uint8_t id, uint16_t if (type == ESP_HIDD_REPORT_TYPE_INTRDATA) { report.type = ESP_HIDD_REPORT_TYPE_INPUT; - report.use_intr = TRUE; + report.use_intr = true; } else { report.type = (type & 0x03); - report.use_intr = FALSE; + report.use_intr = false; } report.id = id; @@ -715,6 +733,19 @@ void btc_hd_call_arg_deep_free(btc_msg_t *msg) case BTC_HD_SEND_REPORT_EVT: utl_freebuf((void **)&arg->send_report.data); break; + case BTC_HD_REGISTER_APP_EVT: { + esp_hidd_app_param_t *app_param = arg->register_app.app_param; + if (app_param) { + utl_freebuf((void **)&app_param->name); + utl_freebuf((void **)&app_param->description); + utl_freebuf((void **)&app_param->provider); + utl_freebuf((void **)&app_param->desc_list); + } + utl_freebuf((void **)&arg->register_app.app_param); + utl_freebuf((void **)&arg->register_app.in_qos); + utl_freebuf((void **)&arg->register_app.out_qos); + break; + } default: break; } @@ -804,7 +835,7 @@ void btc_hd_cb_handler(btc_msg_t *msg) if (p_data->status == BTA_HD_OK){ btc_hd_cb.status = BTC_HD_DISABLED; if (btc_hd_cb.service_dereg_active) { - btc_hd_cb.service_dereg_active = FALSE; + btc_hd_cb.service_dereg_active = false; } free_app_info_param(); memset(&btc_hd_cb, 0, sizeof(btc_hd_cb)); @@ -816,7 +847,7 @@ void btc_hd_cb_handler(btc_msg_t *msg) break; case BTA_HD_REGISTER_APP_EVT: if (p_data->reg_status.status == BTA_HD_OK) { - btc_hd_cb.app_registered = TRUE; + btc_hd_cb.app_registered = true; } param.register_app.status = p_data->reg_status.status; param.register_app.in_use = p_data->reg_status.in_use; @@ -828,7 +859,7 @@ void btc_hd_cb_handler(btc_msg_t *msg) btc_hd_cb_to_app(ESP_HIDD_REGISTER_APP_EVT, ¶m); break; case BTA_HD_UNREGISTER_APP_EVT: - btc_hd_cb.app_registered = FALSE; + btc_hd_cb.app_registered = false; param.unregister_app.status = p_data->status; btc_hd_cb_to_app(ESP_HIDD_UNREGISTER_APP_EVT, ¶m); if (btc_hd_cb.status == BTC_HD_DISABLING) { @@ -845,13 +876,13 @@ void btc_hd_cb_handler(btc_msg_t *msg) // if (check_cod_hid(addr)) { // /* Incoming connection from hid device, reject it */ // BTC_TRACE_WARNING("remote device is not hid host, disconnecting"); - // btc_hd_cb.forced_disc = TRUE; + // btc_hd_cb.forced_disc = true; // BTA_HdDisconnect(); // break; // } // btc_storage_set_hidd((bt_bdaddr_t *)&p_data->conn.bda); btc_hd_cb.status = BTC_HD_CONNECTED; - btc_hd_cb.in_use = TRUE; + btc_hd_cb.in_use = true; } else if (p_data->conn.conn_status == BTA_HD_CONN_STATE_DISCONNECTED) { btc_hd_cb.status = BTC_HD_DISCONNECTED; } @@ -868,7 +899,7 @@ void btc_hd_cb_handler(btc_msg_t *msg) bt_bdaddr_t *addr = (bt_bdaddr_t *)&p_data->conn.bda; BTC_TRACE_WARNING("remote device was forcefully disconnected"); btc_hd_remove_device(*addr); - btc_hd_cb.forced_disc = FALSE; + btc_hd_cb.forced_disc = false; break; } } @@ -924,7 +955,7 @@ void btc_hd_cb_handler(btc_msg_t *msg) btc_hd_cb_to_app(ESP_HIDD_CLOSE_EVT, ¶m); } - btc_hd_cb.in_use = FALSE; + btc_hd_cb.in_use = false; param.vc_unplug.status = p_data->conn.status; param.vc_unplug.conn_status = p_data->conn.conn_status; @@ -964,6 +995,75 @@ void btc_hd_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act); } break; + case BTC_HD_REGISTER_APP_EVT: { + esp_hidd_app_param_t *src_app_param = src->register_app.app_param; + esp_hidd_qos_param_t *src_in_qos = src->register_app.in_qos; + esp_hidd_qos_param_t *src_out_qos = src->register_app.out_qos; + + dst->register_app.app_param = NULL; + dst->register_app.in_qos = NULL; + dst->register_app.out_qos = NULL; + + if (!src_app_param || !src_in_qos || !src_out_qos) { + BTC_TRACE_ERROR("bad app_param(%p), in_qos(%p) or out_qos(%p)", src_app_param, src_in_qos, src_out_qos); + break; + } + if ((src_app_param->desc_list_len <= 0) || (src_app_param->desc_list_len > BTC_HD_APP_DESCRIPTOR_LEN) || !src_app_param->desc_list) { + BTC_TRACE_ERROR("bad desc_list_len (%d) or desc_list(%p)", src_app_param->desc_list_len, src_app_param->desc_list); + break; + } + if (!src_app_param->name || !src_app_param->description || !src_app_param->provider) { + BTC_TRACE_ERROR("bad name(%p), description(%p) or provider(%p)", src_app_param->name, src_app_param->description, src_app_param->provider); + break; + } + + esp_hidd_app_param_t *dst_app_param = (esp_hidd_app_param_t *)osi_malloc(sizeof(esp_hidd_app_param_t)); + esp_hidd_qos_param_t *dst_in_qos = (esp_hidd_qos_param_t *)osi_malloc(sizeof(esp_hidd_qos_param_t)); + esp_hidd_qos_param_t *dst_out_qos = (esp_hidd_qos_param_t *)osi_malloc(sizeof(esp_hidd_qos_param_t)); + size_t name_len = strnlen(src_app_param->name, BTC_HD_APP_NAME_LEN); + size_t description_len = strnlen(src_app_param->description, BTC_HD_APP_DESCRIPTION_LEN); + size_t provider_len = strnlen(src_app_param->provider, BTC_HD_APP_PROVIDER_LEN); + size_t desc_list_len = (size_t)src_app_param->desc_list_len; + char *name = (char *)osi_malloc(name_len + 1); + char *description = (char *)osi_malloc(description_len + 1); + char *provider = (char *)osi_malloc(provider_len + 1); + uint8_t *desc_list = (uint8_t *)osi_malloc(desc_list_len); + + if (!dst_app_param || !dst_in_qos || !dst_out_qos || !name || !description || !provider || !desc_list) { + BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act); + utl_freebuf((void **)&dst_app_param); + utl_freebuf((void **)&dst_in_qos); + utl_freebuf((void **)&dst_out_qos); + utl_freebuf((void **)&name); + utl_freebuf((void **)&description); + utl_freebuf((void **)&provider); + utl_freebuf((void **)&desc_list); + break; + } + + memcpy(name, src_app_param->name, name_len); + name[name_len] = '\0'; + memcpy(description, src_app_param->description, description_len); + description[description_len] = '\0'; + memcpy(provider, src_app_param->provider, provider_len); + provider[provider_len] = '\0'; + memcpy(desc_list, src_app_param->desc_list, desc_list_len); + + dst_app_param->name = name; + dst_app_param->description = description; + dst_app_param->provider = provider; + dst_app_param->subclass = src_app_param->subclass; + dst_app_param->desc_list = desc_list; + dst_app_param->desc_list_len = src_app_param->desc_list_len; + + memcpy(dst_in_qos, src_in_qos, sizeof(esp_hidd_qos_param_t)); + memcpy(dst_out_qos, src_out_qos, sizeof(esp_hidd_qos_param_t)); + + dst->register_app.app_param = dst_app_param; + dst->register_app.in_qos = dst_in_qos; + dst->register_app.out_qos = dst_out_qos; + break; + } default: break; } @@ -987,4 +1087,4 @@ void btc_hd_get_profile_status(esp_hidd_profile_status_t *param) } } -#endif // HID_DEV_INCLUDED==TRUE +#endif // HID_DEV_INCLUDED==true diff --git a/components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c b/components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c index dda5d0bf9d1..228b62cd959 100644 --- a/components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c +++ b/components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c @@ -19,9 +19,9 @@ ******************************************************************************/ /************************************************************************************ * - * Filename: btc_hd.c + * Filename: btc_hh.c * - * Description: HID Device Profile Bluetooth Interface + * Description: HID Host Profile Bluetooth Interface * * ***********************************************************************************/ @@ -68,9 +68,9 @@ static void btc_hh_cb_arg_deep_free(btc_msg_t *msg); static inline void btc_hh_cb_to_app(esp_hidh_cb_event_t event, esp_hidh_cb_param_t *param) { - esp_hh_cb_t btc_hh_cb = (esp_hh_cb_t)btc_profile_cb_get(BTC_PID_HH); - if (btc_hh_cb) { - btc_hh_cb(event, param); + esp_hh_cb_t btc_hh_cbk = (esp_hh_cb_t)btc_profile_cb_get(BTC_PID_HH); + if (btc_hh_cbk) { + btc_hh_cbk(event, param); } } @@ -367,6 +367,23 @@ static void bte_hh_arg_deep_copy(btc_msg_t *msg, void *p_dst, void *p_src) } break; } + case BTA_HH_DATA_IND_EVT: { + BT_HDR *src_hdr = p_src_data->int_data.p_data; + p_dst_data->int_data.p_data = NULL; + if (src_hdr) { + p_dst_data->int_data.p_data = osi_malloc(sizeof(BT_HDR) + src_hdr->len); + if (p_dst_data->int_data.p_data == NULL) { + BTC_TRACE_ERROR("%s malloc int_data.p_data failed!", __func__); + p_dst_data->int_data.status = ESP_HIDH_ERR_NO_RES; + break; + } + BT_HDR *dst_hdr = p_dst_data->int_data.p_data; + memcpy(dst_hdr, src_hdr, sizeof(BT_HDR)); + memcpy(dst_hdr->data, src_hdr->data + src_hdr->offset, src_hdr->len); + dst_hdr->offset = 0; + } + break; + } default: break; } @@ -425,6 +442,9 @@ static void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH *p_data) case BTA_HH_DATA_EVT: param_len = sizeof(tBTA_HH_API_SENDDATA); break; + case BTA_HH_DATA_IND_EVT: + param_len = sizeof(tBTA_HH_INTDATA); + break; case BTA_HH_API_ERR_EVT: param_len = 0; break; @@ -712,6 +732,11 @@ static void btc_hh_set_info(btc_hidh_args_t *arg) esp_hidh_cb_param_t param; tBTA_HH_DEV_DSCP_INFO dscp_info; + if (!arg->set_info.hid_info) { + ret = ESP_HIDH_ERR; + goto _error; + } + BTC_TRACE_DEBUG("%s: sub_class = 0x%02x, app_id = %d, vendor_id = 0x%04x, " "product_id = 0x%04x, version= 0x%04x", __func__, arg->set_info.hid_info->sub_class, arg->set_info.hid_info->app_id, @@ -751,6 +776,7 @@ static void btc_hh_set_info(btc_hidh_args_t *arg) } while(0); utl_freebuf((void **)&dscp_info.descriptor.dsc_list); +_error: if (ret != ESP_HIDH_OK) { param.set_info.status = ret; param.set_info.handle = BTA_HH_INVALID_HANDLE; @@ -1255,7 +1281,7 @@ void btc_hh_cb_handler(btc_msg_t *msg) } if (p_data->status == BTA_HH_OK) { // Clear the control block - for (uint8_t i = 0; i < BTC_HH_MAX_HID; i++) { + for (i = 0; i < BTC_HH_MAX_HID; i++) { if (btc_hh_cb.devices[i].vup_timer) { osi_alarm_free(btc_hh_cb.devices[i].vup_timer); } @@ -1491,11 +1517,11 @@ void btc_hh_cb_handler(btc_msg_t *msg) BTC_TRACE_DEBUG("status = %d, handle = %d", p_data->dev_status.status, p_data->dev_status.handle); param.set_idle.handle = p_data->dev_status.handle; param.set_idle.status = p_data->dev_status.status; - btc_hh_cb_to_app(BTA_HH_SET_IDLE_EVT, ¶m); + btc_hh_cb_to_app(ESP_HIDH_SET_IDLE_EVT, ¶m); break; case BTA_HH_ADD_DEV_EVT: BTC_TRACE_DEBUG("status = %d, handle = %d", p_data->dev_info.status, p_data->dev_info.handle); - for (uint8_t i = 0; i < BTC_HH_MAX_ADDED_DEV; i++) { + for (i = 0; i < BTC_HH_MAX_ADDED_DEV; i++) { if (memcmp(btc_hh_cb.added_devices[i].bd_addr, p_data->dev_info.bda, BD_ADDR_LEN) == 0) { if (p_data->dev_info.status == BTA_HH_OK) { btc_hh_cb.added_devices[i].dev_handle = p_data->dev_info.handle; @@ -1520,8 +1546,8 @@ void btc_hh_cb_handler(btc_msg_t *msg) break; case BTA_HH_RMV_DEV_EVT: BTC_TRACE_DEBUG("status = %d, handle = %d", p_data->dev_info.status, p_data->dev_info.handle); - param.rmv_dev.handle = p_data->dev_info.status; - param.rmv_dev.status = p_data->dev_info.handle; + param.rmv_dev.handle = p_data->dev_info.handle; + param.rmv_dev.status = p_data->dev_info.status; memcpy(param.rmv_dev.bd_addr, p_data->dev_info.bda, BD_ADDR_LEN); btc_hh_cb_to_app(ESP_HIDH_RMV_DEV_EVT, ¶m); break; diff --git a/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c b/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c index e343716b08d..964d375327a 100644 --- a/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c +++ b/components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -55,7 +55,7 @@ static sdp_local_param_t *sdp_local_param_ptr; #if SDP_DYNAMIC_MEMORY == FALSE #define is_sdp_init() (sdp_local_param.sdp_slot_mutex != NULL) #else -#define is_sdp_init() (&sdp_local_param != NULL && sdp_local_param.sdp_slot_mutex != NULL) +#define is_sdp_init() (sdp_local_param_ptr != NULL && sdp_local_param.sdp_slot_mutex != NULL) #endif static void btc_sdp_cleanup(void) @@ -353,21 +353,25 @@ static int free_sdp_slot(int id) sdp_slot_t *slot = NULL; if(id >= SDP_MAX_RECORDS) { - APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id); - return handle; - } - slot = sdp_local_param.sdp_slots[id]; - if (slot == NULL) { - // already freed + BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id); return handle; } osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT); + slot = sdp_local_param.sdp_slots[id]; + if (slot == NULL) { + osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex); + return handle; + } + handle = slot->sdp_handle; if (slot->state != SDP_RECORD_FREE) { /* safe a copy of the pointer, and free after unlock() */ record = slot->record_data; } + + osi_free(sdp_local_param.sdp_slots[id]); + sdp_local_param.sdp_slots[id] = NULL; osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex); if(record != NULL) { @@ -376,8 +380,6 @@ static int free_sdp_slot(int id) // Record have already been freed handle = -1; } - osi_free(sdp_local_param.sdp_slots[id]); - sdp_local_param.sdp_slots[id] = NULL; return handle; } @@ -623,7 +625,7 @@ static int add_mapc_sdp(const bluetooth_sdp_mns_record* rec) sdp_handle = 0; BTC_TRACE_ERROR("%s() FAILED", __func__); } else { - bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */ + bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_NOTIFICATION */ BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle); } @@ -703,7 +705,7 @@ static int add_pbaps_sdp(const bluetooth_sdp_pse_record* rec) sdp_handle = 0; BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status); } else { - bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */ + bta_sys_add_uuid(service); /* UUID_SERVCLASS_PBAP_PSE */ BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle); } @@ -749,7 +751,7 @@ static int add_pbapc_sdp(const bluetooth_sdp_pce_record* rec) sdp_handle = 0; BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status); } else { - bta_sys_add_uuid(service); /* UUID_SERVCLASS_MESSAGE_ACCESS */ + bta_sys_add_uuid(service); /* UUID_SERVCLASS_PBAP_PCE */ BTC_TRACE_DEBUG("%s(): SDP Registered (handle 0x%08x)", __func__, sdp_handle); } @@ -1040,6 +1042,10 @@ static void btc_sdp_cb_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) tBTA_SDP_SEARCH_COMP *dest_search_comp = (tBTA_SDP_SEARCH_COMP *)p_dest; int record_count = src_search_comp->record_count; + if (record_count > BTA_SDP_MAX_RECORDS) { + record_count = BTA_SDP_MAX_RECORDS; + } + for (int i = 0; i < record_count; i++) { bluetooth_sdp_record *src_record = &src_search_comp->records[i]; bluetooth_sdp_record *dest_record = &dest_search_comp->records[i]; @@ -1091,7 +1097,12 @@ static void btc_sdp_cb_arg_deep_free(btc_msg_t *msg) switch (msg->act) { case BTA_SDP_SEARCH_COMP_EVT: { tBTA_SDP_SEARCH_COMP *search_comp = (tBTA_SDP_SEARCH_COMP *)msg->arg; - for (size_t i = 0; i < search_comp->record_count; i++) { + int record_count = search_comp->record_count; + if (record_count > BTA_SDP_MAX_RECORDS) { + record_count = BTA_SDP_MAX_RECORDS; + } + + for (size_t i = 0; i < record_count; i++) { bluetooth_sdp_record *record = &search_comp->records[i]; if (record->hdr.service_name) { osi_free(record->hdr.service_name); @@ -1416,7 +1427,6 @@ void btc_sdp_cb_handler(btc_msg_t *msg) int slot_id = get_sdp_slot_id_by_handle(p_data->sdp_remove_record.handle); if (slot_id < 0) { p_data->sdp_remove_record.status = ESP_SDP_NO_CREATE_RECORD; - break; } else { free_sdp_slot(slot_id); } @@ -1439,7 +1449,7 @@ void btc_sdp_get_protocol_status(esp_sdp_protocol_status_t *param) if (is_sdp_init()) { param->sdp_inited = true; osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT); - for (size_t i = 0; i <= SDP_MAX_RECORDS; i++) { + for (size_t i = 0; i < SDP_MAX_RECORDS; i++) { if (sdp_local_param.sdp_slots[i] != NULL && sdp_local_param.sdp_slots[i]->state == SDP_RECORD_ALLOCED) { param->records_num++; } diff --git a/components/bt/host/bluedroid/external/sbc/decoder/include/oi_codec_sbc.h b/components/bt/host/bluedroid/external/sbc/decoder/include/oi_codec_sbc.h index 495fbf6b914..967c72515e7 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/include/oi_codec_sbc.h +++ b/components/bt/host/bluedroid/external/sbc/decoder/include/oi_codec_sbc.h @@ -372,7 +372,7 @@ OI_STATUS OI_CODEC_SBC_DecodeFrame(OI_CODEC_SBC_DECODER_CONTEXT *context, * * @param frameData Pointer to the SBC data. * - * @param frameBytes Number of bytes avaiable in the frameData buffer + * @param frameBytes Number of bytes available in the frameData buffer * */ OI_UINT8 OI_CODEC_SBC_FrameCount(OI_BYTE *frameData, @@ -447,7 +447,7 @@ OI_UINT16 OI_CODEC_SBC_CalculatePcmBytes(OI_CODEC_SBC_COMMON_CONTEXT *common); * @return pointer to text string containing codec version text * */ -OI_CHAR *OI_CODEC_Version(void); +const OI_CHAR *OI_CODEC_Version(void); /** @@ -457,11 +457,13 @@ OI_CHAR *OI_CODEC_Version(void); @{ */ +#ifdef OI_DEBUG extern const OI_CHAR *const OI_CODEC_SBC_FreqText[]; extern const OI_CHAR *const OI_CODEC_SBC_ModeText[]; extern const OI_CHAR *const OI_CODEC_SBC_SubbandsText[]; extern const OI_CHAR *const OI_CODEC_SBC_BlocksText[]; extern const OI_CHAR *const OI_CODEC_SBC_AllocText[]; +#endif /** @} diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/alloc.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/alloc.c index 3ce6dd7a461..39257b3a828 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/alloc.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/alloc.c @@ -17,7 +17,6 @@ * ******************************************************************************/ #include "common/bt_target.h" -#include #include #if (defined(SBC_DEC_INCLUDED) && SBC_DEC_INCLUDED == TRUE) diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c index 66521630dc8..9ebe21a19c8 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c @@ -25,7 +25,7 @@ @ingroup codec_internal */ -/**@addgroup codec_internal*/ +/**@addtogroup codec_internal*/ /**@{*/ #include "common/bt_target.h" #include @@ -78,7 +78,7 @@ static void stereoBitAllocation(OI_CODEC_SBC_COMMON_CONTEXT *common) } sbL = 0; sbR = nrof_subbands; - while (excess) { + while (excess && sbL < nrof_subbands) { excess = allocExcessBits(&common->bits.uint8[sbL], excess); ++sbL; if (!excess) { @@ -107,7 +107,9 @@ PRIVATE void OI_SBC_ComputeBitAllocation(OI_CODEC_SBC_COMMON_CONTEXT *common) * Using an array of function pointers prevents the compiler from creating a suboptimal * monolithic inlined bit allocation function. */ - balloc[common->frameInfo.mode](common); + if (common->frameInfo.mode < OI_ARRAYSIZE(balloc)) { + balloc[common->frameInfo.mode](common); + } } OI_UINT32 OI_CODEC_SBC_CalculateBitrate(OI_CODEC_SBC_FRAME_INFO *frame) @@ -137,6 +139,10 @@ OI_UINT16 OI_CODEC_SBC_CalculateBitpool(OI_CODEC_SBC_FRAME_INFO *frame, OI_UINT16 hdr; OI_UINT16 bits; + if ((frameLen <= SBC_HEADER_LEN) || (nrof_blocks == 0)) { + return 0; + } + if (frame->mode == SBC_JOINT_STEREO) { hdr = 9 * nrof_subbands; } else { diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc.c index 105876dbb98..20d6ba8bde7 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/bitalloc.c @@ -51,10 +51,11 @@ OI_UINT32 OI_SBC_MaxBitpool(OI_CODEC_SBC_FRAME_INFO *frame) case SBC_STEREO: case SBC_JOINT_STEREO: return 32 * frame->nrof_subbands; + default: + ERROR(("Invalid frame mode %d", frame->mode)); + OI_ASSERT(FALSE); } - ERROR(("Invalid frame mode %d", frame->mode)); - OI_ASSERT(FALSE); return 0; /* Should never be reached */ } @@ -102,10 +103,6 @@ INLINE OI_UINT16 OI_SBC_CalculateFrameAndHeaderlen(OI_CODEC_SBC_FRAME_INFO *fram return internal_CalculateFramelen(frame); } - -#define MIN(x, y) ((x) < (y) ? (x) : (y)) - - /* * Computes the bit need for each sample and as also returns a counts of bit needs that are greater * than one. This count is used in the first phase of bit allocation. @@ -242,7 +239,7 @@ OI_UINT computeBitneed(OI_CODEC_SBC_COMMON_CONTEXT *common, * * @param bitpool The bitpool we have to work within * - * @param bitneeds An array of bit needs (more acturately allocation prioritities) for each + * @param bitneeds An array of bit needs (more acturately allocation priorities) for each * subband across all blocks in the SBC frame * * @param subbands The number of subbands over which the adkustment is calculated. For mono and @@ -309,7 +306,7 @@ OI_INT adjustToFitBitpool(const OI_UINT bitpool, /* - * The bit allocator trys to avoid single bit allocations except as a last resort. So in the case + * The bit allocator tries to avoid single bit allocations except as a last resort. So in the case * where a bitneed of 1 was passed over during the adsjustment phase 2 bits are now allocated. */ INLINE OI_INT allocAdjustedBits(OI_UINT8 *dest, @@ -380,7 +377,7 @@ void oneChannelBitAllocation(OI_CODEC_SBC_COMMON_CONTEXT *common, ++sb; } sb = 0; - while (excess) { + while (excess && (sb < nrof_subbands)) { excess = allocExcessBits(&allocBits[sb], excess); ++sb; } diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-private.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-private.c index f198f579339..42f24da1aee 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-private.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-private.c @@ -36,11 +36,11 @@ This file drives SBC decoding. #include "common/bt_target.h" #include "oi_codec_sbc_private.h" #include "oi_bitstream.h" -#include +#include #if (defined(SBC_DEC_INCLUDED) && SBC_DEC_INCLUDED == TRUE) -OI_CHAR *const OI_Codec_Copyright = "Copyright 2002-2007 Open Interface North America, Inc. All rights reserved"; +const OI_CHAR *const OI_Codec_Copyright = "Copyright 2002-2007 Open Interface North America, Inc. All rights reserved"; INLINE OI_STATUS internal_DecoderReset(OI_CODEC_SBC_DECODER_CONTEXT *context, OI_UINT32 *decoderData, @@ -50,12 +50,9 @@ INLINE OI_STATUS internal_DecoderReset(OI_CODEC_SBC_DECODER_CONTEXT *context, OI_BOOL enhanced, OI_BOOL msbc_enable) { - OI_UINT i; OI_STATUS status; - for (i = 0; i < sizeof(*context); i++) { - ((char *)context)[i] = 0; - } + memset(context, 0, sizeof(*context)); #ifdef SBC_ENHANCED context->enhancedEnabled = enhanced ? TRUE : FALSE; @@ -126,7 +123,7 @@ INLINE void OI_SBC_ReadHeader(OI_CODEC_SBC_COMMON_CONTEXT *common, const OI_BYTE return; } - /* Avoid filling out all these strucutures if we already remember the values + /* Avoid filling out all these structures if we already remember the values * from last time. Just in case we get a stream corresponding to data[1] == * 0, DecoderReset is responsible for ensuring the lookup table entries have * already been populated @@ -179,10 +176,10 @@ PRIVATE void OI_SBC_ReadScalefactors(OI_CODEC_SBC_COMMON_CONTEXT *common, common->frameInfo.join = 0; } i /= 2; - do { + while (i--) { *scale_factor++ = HIGH(f = *b++); *scale_factor++ = LOW(f); - } while (--i); + } /* * In this case we know that the scale factors end on a byte boundary so all we need to do * is initialize the bitstream. @@ -192,10 +189,10 @@ PRIVATE void OI_SBC_ReadScalefactors(OI_CODEC_SBC_COMMON_CONTEXT *common, OI_ASSERT(common->frameInfo.nrof_subbands == 4 && common->frameInfo.mode == SBC_JOINT_STEREO); common->frameInfo.join = HIGH(f = *b++); i = (i - 1) / 2; - do { + while(i--) { *scale_factor++ = LOW(f); *scale_factor++ = HIGH(f = *b++); - } while (--i); + } *scale_factor++ = LOW(f); /* * In 4-subband joint stereo mode, the joint stereo information ends on a half-byte @@ -218,7 +215,7 @@ PRIVATE void OI_SBC_ReadSamples(OI_CODEC_SBC_DECODER_CONTEXT *context, OI_BITSTR OI_UINT bitPtr = global_bs->bitPtr; const OI_UINT iter_count = common->frameInfo.nrof_channels * common->frameInfo.nrof_subbands / 4; - do { + while (nrof_blocks--) { OI_UINT i; for (i = 0; i < iter_count; ++i) { OI_UINT32 sf_by4 = ((OI_UINT32 *)common->scale_factor)[i]; @@ -250,7 +247,7 @@ PRIVATE void OI_SBC_ReadSamples(OI_CODEC_SBC_DECODER_CONTEXT *context, OI_BITSTR *s++ = dequant; } } - } while (--nrof_blocks); + } } /** diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-sbc.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-sbc.c index cb5ed049470..79750b0f10a 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-sbc.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/decoder-sbc.c @@ -386,7 +386,7 @@ OI_UINT8 OI_CODEC_SBC_FrameCount(OI_BYTE *frameData, } /* Extract and translate required fields from Header */ - subbands = mode = blocks = frameData[1];; + subbands = mode = blocks = frameData[1]; mode = (mode & (BIT3 | BIT2)) >> 2; blocks = block_values[(blocks & (BIT5 | BIT4)) >> 4]; subbands = band_values[(subbands & BIT0)]; diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/dequant.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/dequant.c index d165c80a886..cddb6985eb2 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/dequant.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/dequant.c @@ -104,10 +104,6 @@ #define SBC_DEQUANT_LONG_SCALED_OFFSET 1555931970 #endif -#ifndef SBC_DEQUANT_LONG_UNSCALED_OFFSET -#define SBC_DEQUANT_LONG_UNSCALED_OFFSET 2147483648 -#endif - #ifndef SBC_DEQUANT_SCALING_FACTOR #define SBC_DEQUANT_SCALING_FACTOR 1.38019122262781f #endif diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/framing-sbc.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/framing-sbc.c index 4f6056018c7..1aafb61dd6e 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/framing-sbc.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/framing-sbc.c @@ -33,13 +33,13 @@ #if (defined(SBC_DEC_INCLUDED) && SBC_DEC_INCLUDED == TRUE) +#ifdef OI_DEBUG const OI_CHAR *const OI_CODEC_SBC_FreqText[] = { "SBC_FREQ_16000", "SBC_FREQ_32000", "SBC_FREQ_44100", "SBC_FREQ_48000" }; const OI_CHAR *const OI_CODEC_SBC_ModeText[] = { "SBC_MONO", "SBC_DUAL_CHANNEL", "SBC_STEREO", "SBC_JOINT_STEREO" }; const OI_CHAR *const OI_CODEC_SBC_SubbandsText[] = { "SBC_SUBBANDS_4", "SBC_SUBBANDS_8" }; const OI_CHAR *const OI_CODEC_SBC_BlocksText[] = { "SBC_BLOCKS_4", "SBC_BLOCKS_8", "SBC_BLOCKS_12", "SBC_BLOCKS_16" }; const OI_CHAR *const OI_CODEC_SBC_AllocText[] = { "SBC_LOUDNESS", "SBC_SNR" }; -#ifdef OI_DEBUG void OI_CODEC_SBC_DumpConfig(OI_CODEC_SBC_FRAME_INFO *frameInfo) { printf("SBC configuration\n"); @@ -48,8 +48,8 @@ void OI_CODEC_SBC_DumpConfig(OI_CODEC_SBC_FRAME_INFO *frameInfo) printf(" subbands: %d\n", frameInfo->nrof_subbands); printf(" blocks: %d\n", frameInfo->nrof_blocks); printf(" channels: %d\n", frameInfo->nrof_channels); - printf(" mode: %s\n", OI_CODEC_SBC_ModeText[frameInfo->mode]); - printf(" alloc: %s\n", OI_CODEC_SBC_AllocText[frameInfo->alloc]); + printf(" mode: %s\n", (frameInfo->mode < 4) ? OI_CODEC_SBC_ModeText[frameInfo->mode] : "INVALID"); + printf(" alloc: %s\n", (frameInfo->alloc < 2) ? OI_CODEC_SBC_AllocText[frameInfo->alloc] : "INVALID"); printf(" bitpool: %d\n", frameInfo->bitpool); } #endif /* OI_DEBUG */ diff --git a/components/bt/host/bluedroid/external/sbc/decoder/srce/oi_codec_version.c b/components/bt/host/bluedroid/external/sbc/decoder/srce/oi_codec_version.c index 95f8883016e..97b49bc6497 100644 --- a/components/bt/host/bluedroid/external/sbc/decoder/srce/oi_codec_version.c +++ b/components/bt/host/bluedroid/external/sbc/decoder/srce/oi_codec_version.c @@ -39,7 +39,7 @@ version number of the eSBC codec #if (defined(SBC_DEC_INCLUDED) && SBC_DEC_INCLUDED == TRUE) /** Version string for the BLUEmagic 3.0 protocol stack and profiles */ -PRIVATE OI_CHAR *const codecVersion = "v1.5" +PRIVATE const OI_CHAR *const codecVersion = "v1.5" #ifdef OI_SBC_EVAL " (Evaluation version)" #endif @@ -47,7 +47,7 @@ PRIVATE OI_CHAR *const codecVersion = "v1.5" /** This function returns the version string for the BLUEmagic 3.0 protocol stack and profiles */ -OI_CHAR *OI_CODEC_Version(void) +const OI_CHAR *OI_CODEC_Version(void) { return codecVersion; } diff --git a/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_dct.h b/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_dct.h index 165a8c1cd97..3efdee996e6 100644 --- a/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_dct.h +++ b/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_dct.h @@ -30,7 +30,7 @@ { \ __asm \ { \ - MUL s32OutLow,(SINT32)s16In2, (s32In1>>15) \ + MUL s32OutLow,(SINT32)s16In2, (s32In1>>15) \ } \ } #else @@ -43,8 +43,8 @@ #if (SBC_IS_64_MULT_IN_IDCT == TRUE) #define SBC_MULT_32_32(s32In2, s32In1, s32OutLow) \ { \ - s64Temp = ((SINT64) s32In2) * ((SINT64) s32In1)>>31; \ - s32OutLow = (SINT32) s64Temp; \ + s64Temp = ((SINT64) s32In2) * ((SINT64) s32In1)>>31; \ + s32OutLow = (SINT32) s64Temp; \ } #endif #else diff --git a/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_encoder.h b/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_encoder.h index b7b807f536b..80e9679606a 100644 --- a/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_encoder.h +++ b/components/bt/host/bluedroid/external/sbc/encoder/include/sbc_encoder.h @@ -103,26 +103,26 @@ #endif /* Set SBC_IPAQ_OPT to TRUE in case the target is an ARM */ -/* 32 and 64 bit mult will be performed using SINT64 ( usualy __int64 ) cast that usualy give optimal performance if supported */ +/* 32 and 64 bit mult will be performed using SINT64 ( usually __int64 ) cast that usually give optimal performance if supported */ #ifndef SBC_IPAQ_OPT #define SBC_IPAQ_OPT TRUE #endif /* Debug only: set SBC_IS_64_MULT_IN_WINDOW_ACCU to TRUE to use 64 bit multiplication in the windowing */ -/* -> not recomended, more MIPS for the same restitution. */ +/* -> not recommended, more MIPS for the same restitution. */ #ifndef SBC_IS_64_MULT_IN_WINDOW_ACCU #define SBC_IS_64_MULT_IN_WINDOW_ACCU FALSE #endif /*SBC_IS_64_MULT_IN_WINDOW_ACCU */ /* Set SBC_IS_64_MULT_IN_IDCT to TRUE to use 64 bits multiplication in the DCT of Matrixing */ -/* -> more MIPS required for a better audio quality. comparasion with the SIG utilities shows a division by 10 of the RMS */ +/* -> more MIPS required for a better audio quality. comparison with the SIG utilities shows a division by 10 of the RMS */ /* CAUTION: It only apply in the if SBC_FAST_DCT is set to TRUE */ #ifndef SBC_IS_64_MULT_IN_IDCT #define SBC_IS_64_MULT_IN_IDCT FALSE #endif /*SBC_IS_64_MULT_IN_IDCT */ /* set SBC_IS_64_MULT_IN_QUANTIZER to TRUE to use 64 bits multiplication in the quantizer */ -/* setting this flag to FALSE add whistling noise at 5.5 and 11 KHz usualy not perceptible by human's hears. */ +/* setting this flag to FALSE add whistling noise at 5.5 and 11 KHz usually not perceptible by human's hears. */ #ifndef SBC_IS_64_MULT_IN_QUANTIZER #define SBC_IS_64_MULT_IN_QUANTIZER TRUE #endif /*SBC_IS_64_MULT_IN_IDCT */ @@ -183,7 +183,7 @@ typedef struct SBC_ENC_PARAMS_TAG { SINT16 as16PcmBuffer[SBC_MAX_NUM_FRAME * SBC_MAX_NUM_OF_BLOCKS * SBC_MAX_NUM_OF_CHANNELS * SBC_MAX_NUM_OF_SUBBANDS]; #endif - SINT16 s16ScartchMemForBitAlloc[16]; + SINT16 s16ScratchMemForBitAlloc[16]; SINT32 s32SbBuffer[SBC_MAX_NUM_OF_CHANNELS * SBC_MAX_NUM_OF_SUBBANDS * SBC_MAX_NUM_OF_BLOCKS]; diff --git a/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c b/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c index 5f10819bc0e..ab8c5eafa8f 100644 --- a/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c +++ b/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c @@ -62,7 +62,7 @@ void sbc_enc_bit_alloc_mono(SBC_ENC_PARAMS *pstrCodecParams) SINT16 *ps16GenTabPtr; SINT32 s32NumOfSubBands = pstrCodecParams->s16NumOfSubBands; - ps16BitNeed = pstrCodecParams->s16ScartchMemForBitAlloc; + ps16BitNeed = pstrCodecParams->s16ScratchMemForBitAlloc; for (s32Ch = 0; s32Ch < pstrCodecParams->s16NumOfChannels; s32Ch++) { ps16GenBufPtr = ps16BitNeed + s32Ch * s32NumOfSubBands; diff --git a/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c b/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c index 0ef8e7839d2..4aa668adc8b 100644 --- a/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c +++ b/components/bt/host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c @@ -43,11 +43,11 @@ extern const SINT16 sbc_enc_as16Offset8[4][8]; void sbc_enc_bit_alloc_ste(SBC_ENC_PARAMS *pstrCodecParams) { - /* CAUTIOM -> mips optim for arm 32 require to use SINT32 instead of SINT16 */ + /* CAUTION -> mips optim for arm 32 require to use SINT32 instead of SINT16 */ /* Do not change variable type or name */ SINT32 s32MaxBitNeed; /*to store the max bits needed per sb*/ SINT32 s32BitCount; /*the used number of bits*/ - SINT32 s32SliceCount; /*to store hwo many slices can be put in bitpool*/ + SINT32 s32SliceCount; /*to store how many slices can be put in bitpool*/ SINT32 s32BitSlice; /*number of bitslices in bitpool*/ SINT32 s32Sb; /*counter for sub-band*/ SINT32 s32Ch; /*counter for channel*/ @@ -64,7 +64,7 @@ void sbc_enc_bit_alloc_ste(SBC_ENC_PARAMS *pstrCodecParams) ps16BitNeed = pstrCodecParams->as16ScaleFactor; s32MaxBitNeed = pstrCodecParams->s16MaxBitNeed; } else { - ps16BitNeed = pstrCodecParams->s16ScartchMemForBitAlloc; + ps16BitNeed = pstrCodecParams->s16ScratchMemForBitAlloc; pas16ScaleFactor = pstrCodecParams->as16ScaleFactor; s32MaxBitNeed = 0; ps16GenBufPtr = ps16BitNeed; diff --git a/components/bt/host/bluedroid/stack/btm/btm_sco.c b/components/bt/host/bluedroid/stack/btm/btm_sco.c index a9a2d76f46f..30ca99f67fa 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_sco.c +++ b/components/bt/host/bluedroid/stack/btm/btm_sco.c @@ -24,7 +24,6 @@ ******************************************************************************/ #include -#include "stack/bt_types.h" #include "common/bt_target.h" #include "stack/bt_types.h" #include "stack/hcimsgs.h" @@ -283,6 +282,7 @@ static void hci_sco_data_to_lower(BT_HDR *p_buf) if (p_buf->offset == 0) { BTM_TRACE_ERROR("offset cannot be 0"); osi_free(p_buf); + return; } bte_main_hci_send(p_buf, (UINT16)(BT_EVT_TO_LM_HCI_SCO | LOCAL_BLE_CONTROLLER_ID)); @@ -404,10 +404,13 @@ static void btm_pkt_stat_nums_update(uint16_t sco_inx, uint8_t pkt_status) *******************************************************************************/ static void btm_pkt_stat_send_nums_update(uint16_t sco_inx, uint8_t pkt_status) { - tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; - p_ccb->pkt_stat_nums.tx_total++; - if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) { - p_ccb->pkt_stat_nums.tx_discarded++; + tSCO_CONN *p_ccb = NULL; + if (sco_inx < BTM_MAX_SCO_LINKS) { + p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; + p_ccb->pkt_stat_nums.tx_total++; + if (pkt_status != BTM_SUCCESS && pkt_status != BTM_NO_RESOURCES && pkt_status != BTM_SCO_BAD_LENGTH) { + p_ccb->pkt_stat_nums.tx_discarded++; + } } } @@ -460,6 +463,7 @@ void btm_route_sco_data(BT_HDR *p_msg) #if BTM_SCO_HCI_INCLUDED == TRUE UINT16 sco_inx, handle; UINT8 *p = (UINT8 *)(p_msg + 1) + p_msg->offset; + UINT16 len = p_msg->len; UINT8 pkt_size = 0; UINT8 pkt_status = 0; @@ -469,12 +473,12 @@ void btm_route_sco_data(BT_HDR *p_msg) handle = HCID_GET_HANDLE (handle); STREAM_TO_UINT8 (pkt_size, p); + UNUSED(len); UNUSED(pkt_size); if ((sco_inx = btm_find_scb_by_handle(handle)) != BTM_MAX_SCO_LINKS ) { /* send data callback */ - if (!btm_cb.sco_cb.p_data_cb ) + if (!btm_cb.sco_cb.p_data_cb) { /* if no data callback registered, just free the buffer */ - { osi_free (p_msg); } else { btm_pkt_stat_nums_update(sco_inx, pkt_status); @@ -483,7 +487,7 @@ void btm_route_sco_data(BT_HDR *p_msg) } else { /* no mapping handle SCO connection is active, free the buffer */ osi_free (p_msg); } - BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, p_msg->len, pkt_size); + BTM_TRACE_DEBUG ("SCO: hdl %x, len %d, pkt_sz %d\n", handle, len, pkt_size); #else osi_free(p_msg); #endif @@ -515,12 +519,13 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf) { APPL_TRACE_DEBUG("%s", __FUNCTION__); #if (BTM_SCO_HCI_INCLUDED == TRUE) && (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p_ccb = NULL; UINT8 *p; tBTM_STATUS status = BTM_SUCCESS; if (sco_inx < BTM_MAX_SCO_LINKS && btm_cb.sco_cb.p_data_cb && - p_ccb->state == SCO_ST_CONNECTED) { + btm_cb.sco_cb.sco_db[sco_inx].state == SCO_ST_CONNECTED) { + p_ccb = &btm_cb.sco_cb.sco_db[sco_inx]; /* Ensure we have enough space in the buffer for the SCO and HCI headers */ if (p_buf->offset < HCI_SCO_PREAMBLE_SIZE) { BTM_TRACE_ERROR ("BTM SCO - cannot send buffer, offset: %d", p_buf->offset); @@ -556,8 +561,12 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf) } } } else { - BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]", - sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state); + if (sco_inx < BTM_MAX_SCO_LINKS) { + BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d at state [%d]", + sco_inx, btm_cb.sco_cb.sco_db[sco_inx].state); + } else { + BTM_TRACE_WARNING ("BTM_WriteScoData, invalid sco index: %d", sco_inx); + } status = BTM_UNKNOWN_ADDR; } @@ -565,7 +574,9 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf) BTM_TRACE_WARNING ("stat %d", status); osi_free(p_buf); } - btm_pkt_stat_send_nums_update(sco_inx, status); + if (sco_inx < BTM_MAX_SCO_LINKS) { + btm_pkt_stat_send_nums_update(sco_inx, status); + } return (status); #else @@ -721,8 +732,13 @@ void btm_accept_sco_link(UINT16 sco_inx, tBTM_ESCO_PARAMS *p_setup, ** Returns void ** *******************************************************************************/ -void btm_reject_sco_link( UINT16 sco_inx ) +void btm_reject_sco_link( UINT16 sco_inx) { + if (sco_inx >= BTM_MAX_SCO_LINKS) { + BTM_TRACE_ERROR("btm_reject_sco_link: Invalid sco_inx(%d)", sco_inx); + return; + } + btm_esco_conn_rsp(sco_inx, HCI_ERR_HOST_REJECT_RESOURCES, btm_cb.sco_cb.sco_db[sco_inx].esco.data.bd_addr, NULL); } @@ -1166,11 +1182,15 @@ UINT16 btm_find_scb_by_handle (UINT16 handle) tBTM_STATUS BTM_RemoveSco (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) + if (sco_inx >= BTM_MAX_SCO_LINKS) { + return (BTM_UNKNOWN_ADDR); + } + tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; UINT16 tempstate; /* Validity check */ - if ((sco_inx >= BTM_MAX_SCO_LINKS) || (p->state == SCO_ST_UNUSED)) { + if (p->state == SCO_ST_UNUSED) { return (BTM_UNKNOWN_ADDR); } @@ -1368,10 +1388,12 @@ tBTM_STATUS BTM_SetScoPacketTypes (UINT16 sco_inx, UINT16 pkt_types) UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p = NULL; /* Validity check */ - if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) { + if ((sco_inx < BTM_MAX_SCO_LINKS) && + ((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && + (p->state == SCO_ST_CONNECTED)) { return (p->esco.setup.packet_types); } else { return (0); @@ -1420,10 +1442,12 @@ UINT16 BTM_ReadDeviceScoPacketTypes (void) UINT16 BTM_ReadScoHandle (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p = NULL;; /* Validity check */ - if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->state == SCO_ST_CONNECTED)) { + if ((sco_inx < BTM_MAX_SCO_LINKS) && + ((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && + (p->state == SCO_ST_CONNECTED)) { return (p->hci_handle); } else { return (BTM_INVALID_HCI_HANDLE); @@ -1446,10 +1470,11 @@ UINT16 BTM_ReadScoHandle (UINT16 sco_inx) UINT8 *BTM_ReadScoBdAddr (UINT16 sco_inx) { #if (BTM_MAX_SCO_LINKS>0) - tSCO_CONN *p = &btm_cb.sco_cb.sco_db[sco_inx]; + tSCO_CONN *p = NULL; /* Validity check */ - if ((sco_inx < BTM_MAX_SCO_LINKS) && (p->rem_bd_known)) { + if ((sco_inx < BTM_MAX_SCO_LINKS) && + ((p = &btm_cb.sco_cb.sco_db[sco_inx]) != NULL) && (p->rem_bd_known)) { return (p->esco.data.bd_addr); } else { return (NULL); @@ -1533,7 +1558,9 @@ tBTM_STATUS BTM_RegForEScoEvts (UINT16 sco_inx, tBTM_ESCO_CBACK *p_esco_cback) { #if (BTM_MAX_SCO_LINKS>0) if (!btm_cb.sco_cb.esco_supported) { - btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL; + if (sco_inx < BTM_MAX_SCO_LINKS) { + btm_cb.sco_cb.sco_db[sco_inx].esco.p_esco_cback = NULL; + } return (BTM_MODE_UNSUPPORTED); } diff --git a/components/bt/host/bluedroid/stack/gap/gap_conn.c b/components/bt/host/bluedroid/stack/gap/gap_conn.c index 2fa54fa9232..61a4684daf8 100644 --- a/components/bt/host/bluedroid/stack/gap/gap_conn.c +++ b/components/bt/host/bluedroid/stack/gap/gap_conn.c @@ -130,7 +130,6 @@ UINT16 GAP_ConnOpen (const char *p_serv_name, UINT8 service_id, BOOLEAN is_serve { tGAP_CCB *p_ccb; UINT16 cid; - //tBT_UUID bt_uuid = {2, {GAP_PROTOCOL_ID}}; GAP_TRACE_EVENT ("GAP_CONN - Open Request"); @@ -149,6 +148,7 @@ UINT16 GAP_ConnOpen (const char *p_serv_name, UINT8 service_id, BOOLEAN is_serve memcpy (&p_ccb->rem_dev_address[0], p_rem_bda, BD_ADDR_LEN); } else if (!is_server) { /* remote addr is not specified and is not a server -> bad */ + gap_release_ccb (p_ccb); return (GAP_INVALID_HANDLE); } @@ -234,7 +234,7 @@ UINT16 GAP_ConnOpen (const char *p_serv_name, UINT8 service_id, BOOLEAN is_serve } /* Check if L2CAP started the connection process */ - if (p_rem_bda && ((cid = L2CA_CONNECT_REQ (p_ccb->psm, p_rem_bda, &p_ccb->ertm_info, &bt_uuid)) != 0)) { + if (p_rem_bda && ((cid = L2CA_CONNECT_REQ (p_ccb->psm, p_rem_bda, &p_ccb->ertm_info, NULL)) != 0)) { p_ccb->connection_id = cid; return (p_ccb->gap_handle); } else { @@ -304,15 +304,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1 if (!p_ccb) { return (GAP_ERR_BAD_HANDLE); } + if (!p_len) { + return (GAP_ERR_ILL_PARM); + } *p_len = 0; + osi_mutex_global_lock(); + if (fixed_queue_is_empty(p_ccb->rx_queue)) { + osi_mutex_global_unlock(); return (GAP_NO_DATA_AVAIL); } - osi_mutex_global_lock(); - while (max_len) { BT_HDR *p_buf = fixed_queue_try_peek_first(p_ccb->rx_queue); if (p_buf == NULL) { @@ -359,19 +363,19 @@ UINT16 GAP_ConnReadData (UINT16 gap_handle, UINT8 *p_data, UINT16 max_len, UINT1 int GAP_GetRxQueueCnt (UINT16 handle, UINT32 *p_rx_queue_count) { tGAP_CCB *p_ccb; - int rc = BT_PASS; + int rc = GAP_INVALID_HANDLE; + + if (!p_rx_queue_count) { + return GAP_ERR_ILL_PARM; + } /* Check that handle is valid */ - if (handle < GAP_MAX_CONNECTIONS) { - p_ccb = &gap_cb.conn.ccb_pool[handle]; - + p_ccb = gap_find_ccb_by_handle (handle); + if (p_ccb) { if (p_ccb->con_state == GAP_CCB_STATE_CONNECTED) { *p_rx_queue_count = p_ccb->rx_queue_size; - } else { - rc = GAP_INVALID_HANDLE; + rc = BT_PASS; } - } else { - rc = GAP_INVALID_HANDLE; } GAP_TRACE_EVENT ("GAP_GetRxQueueCnt - rc = 0x%04x, rx_queue_count=%d", @@ -721,7 +725,6 @@ static void gap_connect_ind (BD_ADDR bd_addr, UINT16 l2cap_cid, UINT16 psm, UIN { UINT16 xx; tGAP_CCB *p_ccb; - //tBT_UUID bt_uuid = {2, {GAP_PROTOCOL_ID}}; /* See if we have a CCB listening for the connection */ for (xx = 0, p_ccb = gap_cb.conn.ccb_pool; xx < GAP_MAX_CONNECTIONS; xx++, p_ccb++) { @@ -751,7 +754,7 @@ static void gap_connect_ind (BD_ADDR bd_addr, UINT16 l2cap_cid, UINT16 psm, UIN p_ccb->connection_id = l2cap_cid; /* Send response to the L2CAP layer. */ - L2CA_CONNECT_RSP (bd_addr, l2cap_id, l2cap_cid, L2CAP_CONN_OK, L2CAP_CONN_OK, &p_ccb->ertm_info, &bt_uuid); + L2CA_CONNECT_RSP (bd_addr, l2cap_id, l2cap_cid, L2CAP_CONN_OK, L2CAP_CONN_OK, &p_ccb->ertm_info, NULL); GAP_TRACE_EVENT("GAP_CONN - Rcvd L2CAP conn ind, CID: 0x%x", p_ccb->connection_id); diff --git a/components/bt/host/bluedroid/stack/goep/goepc_api.c b/components/bt/host/bluedroid/stack/goep/goepc_api.c index 06be8f59cbe..c34112314f6 100644 --- a/components/bt/host/bluedroid/stack/goep/goepc_api.c +++ b/components/bt/host/bluedroid/stack/goep/goepc_api.c @@ -84,7 +84,7 @@ UINT16 GOEPC_Open(tOBEX_SVR_INFO *svr, tGOEPC_EVT_CBACK callback, UINT16 *out_ha p_ccb = goepc_allocate_ccb(); if (p_ccb == NULL) { - ret = GOEP_NO_RESOURCES; + ret = GOEP_NO_RESOURCES; break; } diff --git a/components/bt/host/bluedroid/stack/goep/goepc_main.c b/components/bt/host/bluedroid/stack/goep/goepc_main.c index e0859580ec6..7c3cb778d03 100644 --- a/components/bt/host/bluedroid/stack/goep/goepc_main.c +++ b/components/bt/host/bluedroid/stack/goep/goepc_main.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -80,6 +80,7 @@ static tGOEPC_CCB *find_ccb_by_obex_handle(UINT16 obex_handle) for (int i = 0; i < GOEPC_MAX_CONNECTION; ++i) { if (goepc_cb.ccb[i].allocated && goepc_cb.ccb[i].obex_handle == obex_handle) { p_ccb = &goepc_cb.ccb[i]; + break; } } return p_ccb; @@ -182,7 +183,7 @@ void goepc_obex_callback(UINT16 handle, UINT8 event, tOBEX_MSG *msg) case OBEX_DISCONNECT_EVT: /* when we received this event, obex connection already disconnect */ p_ccb->obex_handle = 0; - goepc_sm_event = GOEPC_SM_EVENT_DISCONNECT;; + goepc_sm_event = GOEPC_SM_EVENT_DISCONNECT; exec_sm = TRUE; break; case OBEX_CONGEST_EVT: @@ -315,11 +316,16 @@ static void goepc_sm_state_opening(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA * GOEPC_TRACE_ERROR("goepc_sm_state_opening received unexpected response from peer\n"); if (p_data->pkt != NULL) { osi_free(p_data->pkt); + p_data->pkt = NULL; } goepc_sm_act_disconnect(p_ccb); break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opening unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -348,6 +354,10 @@ static void goepc_sm_state_opened_idle(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DA break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opened_idle unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -373,6 +383,10 @@ static void goepc_sm_state_opened_req(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DAT break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opened_req unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -395,6 +409,10 @@ static void goepc_sm_state_opened_rsp(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DAT break; default: GOEPC_TRACE_ERROR("goepc_sm_state_opened_rsp unexpected event: 0x%x\n", event); + if (p_data->pkt != NULL) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } break; } } @@ -430,10 +448,14 @@ BOOLEAN goepc_check_obex_req_allow(UINT8 state, BOOLEAN final) void goepc_sm_execute(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *p_data) { + bool free_pkt = false; + bool has_pkt = false; + switch (p_ccb->state) { case GOEPC_STATE_INIT: /* do nothing */ + free_pkt = true; break; case GOEPC_STATE_OPENING: goepc_sm_state_opening(p_ccb, event, p_data); @@ -448,9 +470,34 @@ void goepc_sm_execute(tGOEPC_CCB *p_ccb, UINT8 event, tGOEPC_DATA *p_data) goepc_sm_state_opened_rsp(p_ccb, event, p_data); break; default: + free_pkt = true; GOEPC_TRACE_ERROR("goepc_sm_execute unexpected state: 0x%x\n", p_ccb->state); break; } + + switch (event) + { + case GOEPC_SM_EVENT_REQ: + /* falls through */ + case GOEPC_SM_EVENT_REQ_FB: + /* falls through */ + case GOEPC_SM_EVENT_RSP: + /* falls through */ + case GOEPC_SM_EVENT_RSP_FB: + /* falls through */ + has_pkt = true; + break; + default: + has_pkt = false; + break; + } + + if (has_pkt && free_pkt) { + if (p_data->pkt) { + osi_free(p_data->pkt); + p_data->pkt = NULL; + } + } } static void goepc_srm_sm_act_req(tGOEPC_CCB *p_ccb, BOOLEAN srm_en, BOOLEAN srm_wait) diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c b/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c index 6236f12a946..89d74b998fb 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c @@ -33,7 +33,6 @@ #include "l2c_int.h" #include "btm_int.h" #include "stack/btu.h" -#include "stack/hcimsgs.h" #include "osi/allocator.h" #if (L2CAP_COC_INCLUDED == TRUE) @@ -121,7 +120,6 @@ void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data) *******************************************************************************/ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data) { - tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data; UINT16 local_cid = p_ccb->local_cid; tL2CA_DISCONNECT_IND_CB *disconnect_ind; tL2CA_CONNECT_CFM_CB *connect_cfm; @@ -168,6 +166,7 @@ static void l2c_csm_closed (tL2C_CCB *p_ccb, UINT16 event, void *p_data) break; case L2CEVT_LP_CONNECT_CFM_NEG: /* Link failed */ + tL2C_CONN_INFO *p_ci = (tL2C_CONN_INFO *)p_data; /* Disconnect unless ACL collision and upper layer wants to handle it */ if (p_ci->status != HCI_ERR_CONNECTION_EXISTS || !btm_acl_notif_conn_collision(p_ccb->p_lcb->remote_bd_addr)) { diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c b/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c index 4d3c2620131..684825f487f 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_fcr.c @@ -892,7 +892,7 @@ static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word) /* If anything still waiting for ack, restart the timer if it was stopped */ if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q)) { l2c_fcr_start_timer(p_ccb); - } + } return (TRUE); } @@ -1342,7 +1342,7 @@ static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_wo p_buf->len -= 2; if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) { - L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len); + L2CAP_TRACE_WARNING ("SAR - SDU len: %u larger than MTU: %u", p_fcrb->rx_sdu_len, p_ccb->max_rx_mtu); packet_ok = FALSE; } else if ((p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL) { L2CAP_TRACE_ERROR ("SAR - no buffer for SDU start user_rx_buf_size:%d", p_ccb->ertm_info.user_rx_buf_size); @@ -1451,7 +1451,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq) if (tx_seq == buf_seq) { break; - } + } } } @@ -1466,24 +1466,24 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq) // the transmit data queue that satisfy the layer and event conditions. for (const list_node_t *node = list_begin(p_ccb->p_lcb->link_xmit_data_q); node != list_end(p_ccb->p_lcb->link_xmit_data_q);) { - BT_HDR *p_buf = (BT_HDR *)list_node(node); + BT_HDR *p_node_buf = (BT_HDR *)list_node(node); node = list_next(node); /* Do not flush other CIDs or partial segments */ - if ((p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid)) { - list_remove(p_ccb->p_lcb->link_xmit_data_q, p_buf); - osi_free(p_buf); + if ((p_node_buf->layer_specific == 0) && (p_node_buf->event == p_ccb->local_cid)) { + list_remove(p_ccb->p_lcb->link_xmit_data_q, p_node_buf); + osi_free(p_node_buf); } } /* Also flush our retransmission queue */ while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q)) { osi_free(fixed_queue_dequeue(p_ccb->fcrb.retrans_q, 0)); - } + } if (list_ack != NULL) { node_ack = list_begin(list_ack); - } + } } if (list_ack != NULL) { @@ -1502,7 +1502,7 @@ static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq) if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) ) { break; - } + } } } @@ -2150,11 +2150,11 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked) if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index]) { p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q); - } + } if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index]) { p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q); - } + } /* update sum, max and min of round trip delay of acking */ list_t *list = NULL; @@ -2186,7 +2186,7 @@ static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked) if ( delay < p_ccb->fcrb.ack_delay_min[index] ) { p_ccb->fcrb.ack_delay_min[index] = delay; } - } + } } } diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c b/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c index d2de138b223..d3a108bdc44 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_ucd.c @@ -90,6 +90,12 @@ static void l2c_ucd_data_ind_cback (BD_ADDR rem_bda, BT_HDR *p_buf) L2CAP_TRACE_DEBUG ("L2CAP - l2c_ucd_data_ind_cback"); + if (p_buf->len < L2CAP_UCD_OVERHEAD) { + L2CAP_TRACE_ERROR ("L2CAP - data not enough for l2c_ucd_data_ind_cback %d", p_buf->len); + osi_free (p_buf); + return; + } + p = (UINT8 *)(p_buf + 1) + p_buf->offset; STREAM_TO_UINT16(psm, p) @@ -185,7 +191,7 @@ static void l2c_ucd_config_cfm_cback (UINT16 cid, tL2CAP_CFG_INFO *p_cfg) ** ** Parameters: tL2CAP_UCD_CB_INFO ** -** Return value: TRUE if successs +** Return value: TRUE if success ** *******************************************************************************/ BOOLEAN L2CA_UcdRegister ( UINT16 psm, tL2CAP_UCD_CB_INFO *p_cb_info ) @@ -242,12 +248,12 @@ BOOLEAN L2CA_UcdRegister ( UINT16 psm, tL2CAP_UCD_CB_INFO *p_cb_info ) ** ** Parameters: PSM ** -** Return value: TRUE if successs +** Return value: TRUE if success ** *******************************************************************************/ BOOLEAN L2CA_UcdDeregister_In_CCB_List (void *p_ccb_node, void * context) { - p_ccb = (tL2C_CCB *)p_ccb_node; + tL2C_CCB *p_ccb = (tL2C_CCB *)p_ccb_node; if (( p_ccb->in_use ) && ( p_ccb->local_cid == L2CAP_CONNECTIONLESS_CID )) { l2cu_release_ccb (p_ccb); @@ -257,7 +263,6 @@ BOOLEAN L2CA_UcdDeregister_In_CCB_List (void *p_ccb_node, void * context) BOOLEAN L2CA_UcdDeregister ( UINT16 psm ) { - tL2C_CCB *p_ccb; tL2C_RCB *p_rcb; UINT16 xx; @@ -301,7 +306,7 @@ BOOLEAN L2CA_UcdDeregister ( UINT16 psm ) ** L2CAP_UCD_INFO_TYPE_MTU ** ** -** Return value: TRUE if successs +** Return value: TRUE if success ** *******************************************************************************/ BOOLEAN L2CA_UcdDiscover ( UINT16 psm, BD_ADDR rem_bda, UINT8 info_type ) @@ -450,7 +455,7 @@ UINT16 L2CA_UcdDataWrite (UINT16 psm, BD_ADDR rem_bda, BT_HDR *p_buf, UINT16 fla ** Parameters: BD Addr ** Timeout in second ** -** Return value: TRUE if successs +** Return value: TRUE if success ** *******************************************************************************/ BOOLEAN L2CA_UcdSetIdleTimeout ( BD_ADDR rem_bda, UINT16 timeout ) @@ -517,7 +522,7 @@ BOOLEAN L2CA_UCDSetTxPriority ( BD_ADDR rem_bda, tL2CAP_CHNL_PRIORITY priority ) ** ** Parameters: BD_ADDR of remote device ** -** Return value: TRUE if successs +** Return value: TRUE if success ** *******************************************************************************/ static BOOLEAN l2c_ucd_connect ( BD_ADDR rem_bda ) @@ -597,7 +602,7 @@ static BOOLEAN l2c_ucd_connect ( BD_ADDR rem_bda ) void l2c_ucd_delete_sec_pending_q(tL2C_LCB *p_lcb) { /* clean up any security pending UCD */ - while (p_lcb->ucd_out_sec_pending_q.p_first) { + while (!fixed_queue_is_empty(p_lcb->ucd_out_sec_pending_q)) { osi_free(fixed_queue_dequeue(p_lcb->ucd_out_sec_pending_q, 0)); } fixed_queue_free(p_lcb->ucd_out_sec_pending_q, NULL); @@ -606,7 +611,7 @@ void l2c_ucd_delete_sec_pending_q(tL2C_LCB *p_lcb) while (! fixed_queue_is_empty(p_lcb->ucd_in_sec_pending_q)) { osi_free(fixed_queue_dequeue(p_lcb->ucd_in_sec_pending_q, 0)); } - fixed_queue_free(p_lcb->ucd_in_sec_pending_q); + fixed_queue_free(p_lcb->ucd_in_sec_pending_q, NULL); p_lcb->ucd_in_sec_pending_q = NULL; } @@ -797,7 +802,7 @@ BOOLEAN l2c_ucd_check_pending_in_sec_q(tL2C_CCB *p_ccb) *******************************************************************************/ void l2c_ucd_send_pending_in_sec_q(tL2C_CCB *p_ccb) { - BT_HDR *p_buf = (BT_HDR*)fixed_queue_dequeue(p_ccb->p_lcb->ucd_in_sec_pending_q, 0) + BT_HDR *p_buf = (BT_HDR*)fixed_queue_dequeue(p_ccb->p_lcb->ucd_in_sec_pending_q, 0); if (p_buf != NULL) { p_ccb->p_rcb->ucd.cb_info.pL2CA_UCD_Data_Cb(p_ccb->p_lcb->remote_bd_addr, (BT_HDR *)p_buf); diff --git a/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c b/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c index c7314b62ff0..3e8ae9c51f9 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2cap_client.c @@ -107,7 +107,7 @@ l2cap_client_t *l2cap_client_new(const l2cap_client_callbacks_t *callbacks, void ret->remote_mtu = L2CAP_MTU_DEFAULT; ret->outbound_fragments = list_new(NULL); - if (!ret) { + if (!ret->outbound_fragments) { L2CAP_TRACE_ERROR("%s unable to allocate outbound L2CAP fragment list.", __func__); goto error; } @@ -368,11 +368,18 @@ static void read_ready_cb(uint16_t local_channel_id, BT_HDR *packet) l2cap_client_t *client = find(local_channel_id); if (!client) { L2CAP_TRACE_ERROR("%s unable to find L2CAP client matching LCID 0x%04x.\n", __func__, local_channel_id); + osi_free(packet); return; } // TODO(sharvil): eliminate copy from BT_HDR. buffer_t *buffer = buffer_new(packet->len); + if (!buffer) { + L2CAP_TRACE_ERROR("%s unable to new a buffer\n", __func__); + osi_free(packet); + return; + } + memcpy(buffer_ptr(buffer), packet->data + packet->offset, packet->len); osi_free(packet); @@ -393,7 +400,7 @@ static void fragment_packet(l2cap_client_t *client, buffer_t *packet) assert(packet != NULL); // TODO(sharvil): eliminate copy into BT_HDR. - BT_HDR *bt_packet = osi_malloc(buffer_length(packet) + L2CAP_MIN_OFFSET); + BT_HDR *bt_packet = osi_malloc(sizeof(BT_HDR) + buffer_length(packet) + L2CAP_MIN_OFFSET); bt_packet->offset = L2CAP_MIN_OFFSET; bt_packet->len = buffer_length(packet); memcpy(bt_packet->data + bt_packet->offset, buffer_ptr(packet), buffer_length(packet)); @@ -408,7 +415,7 @@ static void fragment_packet(l2cap_client_t *client, buffer_t *packet) break; } - BT_HDR *fragment = osi_malloc(client->remote_mtu + L2CAP_MIN_OFFSET); + BT_HDR *fragment = osi_malloc(sizeof(BT_HDR) + client->remote_mtu + L2CAP_MIN_OFFSET); fragment->offset = L2CAP_MIN_OFFSET; fragment->len = client->remote_mtu; memcpy(fragment->data + fragment->offset, bt_packet->data + bt_packet->offset, client->remote_mtu); diff --git a/components/bt/host/bluedroid/stack/obex/obex_api.c b/components/bt/host/bluedroid/stack/obex/obex_api.c index b9df8eb4ae4..361f2c1fdd1 100644 --- a/components/bt/host/bluedroid/stack/obex/obex_api.c +++ b/components/bt/host/bluedroid/stack/obex/obex_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -31,7 +31,7 @@ static inline void obex_server_to_tl_server(tOBEX_SVR_INFO *server, tOBEX_TL_SVR } } -static inline void obex_updata_packet_length(BT_HDR *p_buf, UINT16 len) +static inline void obex_update_packet_length(BT_HDR *p_buf, UINT16 len) { UINT8 *p_pkt_len = (UINT8 *)(p_buf + 1) + p_buf->offset + 1; UINT16_TO_BE_FIELD(p_pkt_len, len); @@ -59,13 +59,13 @@ UINT16 OBEX_Init(void) #endif /* #if (OBEX_DYNAMIC_MEMORY) */ memset(&obex_cb, 0, sizeof(tOBEX_CB)); obex_cb.tl_ops[OBEX_OVER_L2CAP] = obex_tl_l2cap_ops_get(); - if (obex_cb.tl_ops[OBEX_OVER_L2CAP]->init != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_L2CAP] && obex_cb.tl_ops[OBEX_OVER_L2CAP]->init) { obex_cb.tl_ops[OBEX_OVER_L2CAP]->init(obex_tl_l2cap_callback); } /* Not implement yet */ /* obex_cb.tl_ops[OBEX_OVER_RFCOMM] = obex_tl_rfcomm_ops_get(); - if (obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_RFCOMM] && obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init) { obex_cb.tl_ops[OBEX_OVER_RFCOMM]->init(obex_tl_rfcomm_callback); } */ @@ -83,11 +83,11 @@ UINT16 OBEX_Init(void) *******************************************************************************/ void OBEX_Deinit(void) { - if (obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_L2CAP] && obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit) { obex_cb.tl_ops[OBEX_OVER_L2CAP]->deinit(); } /* - if (obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit != NULL) { + if (obex_cb.tl_ops[OBEX_OVER_RFCOMM] && obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit) { obex_cb.tl_ops[OBEX_OVER_RFCOMM]->deinit(); } */ @@ -115,7 +115,7 @@ UINT16 OBEX_CreateConn(tOBEX_SVR_INFO *server, tOBEX_MSG_CBACK callback, UINT16 tOBEX_CCB *p_ccb = NULL; do { - if (server->tl >= OBEX_NUM_TL) { + if (!server || (server->tl >= OBEX_NUM_TL)) { ret = OBEX_INVALID_PARAM; break; } @@ -138,7 +138,9 @@ UINT16 OBEX_CreateConn(tOBEX_SVR_INFO *server, tOBEX_MSG_CBACK callback, UINT16 p_ccb->callback = callback; p_ccb->role = OBEX_ROLE_CLIENT; p_ccb->state = OBEX_STATE_OPENING; - *out_handle = p_ccb->allocated; + if (out_handle) { + *out_handle = p_ccb->allocated; + } } while (0); if (ret != OBEX_SUCCESS && p_ccb != NULL) { @@ -319,7 +321,7 @@ UINT16 OBEX_BuildRequest(tOBEX_PARSE_INFO *info, UINT16 buff_size, BT_HDR **out_ } buff_size += sizeof(BT_HDR) + OBEX_BT_HDR_MIN_OFFSET; - BT_HDR *p_buf= (BT_HDR *)osi_malloc(buff_size); + BT_HDR *p_buf = (BT_HDR *)osi_malloc(buff_size); if (p_buf == NULL) { return OBEX_NO_RESOURCES; } @@ -621,20 +623,35 @@ UINT16 OBEX_ParseRequest(BT_HDR *pkt, tOBEX_PARSE_INFO *info) } UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset; + UINT16 len = pkt->len; + + if (len < 1) { + return OBEX_FAILURE; + } + info->opcode = *p_data; switch (info->opcode) { case OBEX_OPCODE_CONNECT: + if (len < 7) { + return OBEX_FAILURE; + } info->obex_version_number = p_data[3]; info->flags = p_data[4]; info->max_packet_length = (p_data[5] << 8) + p_data[6]; info->next_header_pos = 7; break; case OBEX_OPCODE_SETPATH: + if (len < 5) { + return OBEX_FAILURE; + } info->flags = p_data[3]; info->next_header_pos = 5; break; default: + if (len < 3) { + return OBEX_FAILURE; + } info->next_header_pos = 3; break; } @@ -757,10 +774,10 @@ UINT8 *OBEX_GetNextHeader(BT_HDR *pkt, tOBEX_PARSE_INFO *info) if (pkt == NULL || info == NULL) { return NULL; } - UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset; if (info->next_header_pos == 0 || info->next_header_pos >= pkt->len) { return NULL; } + UINT8 *p_data = (UINT8 *)(pkt + 1) + pkt->offset; UINT8 *header = p_data + info->next_header_pos; UINT16 header_len = OBEX_GetHeaderLength(header); info->next_header_pos += header_len; diff --git a/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c b/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c index d509b4cfabf..888866c0286 100644 --- a/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c +++ b/components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -554,7 +554,7 @@ void obex_tl_l2cap_congestion_status_ind(UINT16 lcid, BOOLEAN is_congested) ** other APIs ** *******************************************************************************/ -void obex_tl_l2cap_init(tOBEX_TL_CBACK callback) +void obex_tl_l2cap_init(tOBEX_TL_CBACK *callback) { assert(callback != NULL); #if (OBEX_DYNAMIC_MEMORY) @@ -587,7 +587,7 @@ void obex_tl_l2cap_init(tOBEX_TL_CBACK callback) /******************************************************************************* ** -** Function obex_tl_l2cap_init +** Function obex_tl_l2cap_deinit ** ** Description Deinitialize OBEX over L2CAP transport layer ** @@ -674,7 +674,7 @@ void obex_tl_l2cap_disconnect(UINT16 hdl) ** ** Function obex_tl_l2cap_send_data ** -** Description Start the process of establishing a L2CAP connection +** Description Send data on an established L2CAP connection ** ** Returns OBEX_TL_SUCCESS, if data accepted ** OBEX_TL_CONGESTED, if data accepted and the channel is congested diff --git a/components/bt/host/bluedroid/stack/rfcomm/port_api.c b/components/bt/host/bluedroid/stack/rfcomm/port_api.c index a6b5920cdbc..b09e89d158f 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/port_api.c +++ b/components/bt/host/bluedroid/stack/rfcomm/port_api.c @@ -114,7 +114,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server, RFCOMM_TRACE_API ("RFCOMM_CreateConnection() BDA: %02x-%02x-%02x-%02x-%02x-%02x", bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4], bd_addr[5]); - *p_handle = 0; + if (p_handle) { + *p_handle = 0; + } if (( scn == 0 ) || (scn >= PORT_MAX_RFC_PORTS )) { /* Server Channel Number(SCN) should be in range 1...30 */ @@ -170,7 +172,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server, RFCOMM_TRACE_EVENT ("RFCOMM_CreateConnection dlci:%d signal state:0x%x", dlci, p_port->default_signal_state); - *p_handle = p_port->inx; + if (p_handle) { + *p_handle = p_port->inx; + } p_port->state = PORT_STATE_OPENING; p_port->uuid = uuid; diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c index aa28da9d1b9..2f866968041 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c @@ -421,7 +421,7 @@ tRFC_MCB *rfc_find_lcid_mcb (UINT16 lcid) ** ** Function rfc_save_lcid_mcb ** -** Description This function returns MCB block supporting local cid +** Description This function saves MCB block supporting local cid ** *******************************************************************************/ void rfc_save_lcid_mcb (tRFC_MCB *p_mcb, UINT16 lcid) diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c index d3986813c33..60f433dc908 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c @@ -119,6 +119,9 @@ void rfc_mx_sm_execute (tRFC_MCB *p_mcb, UINT16 event, void *p_data) rfc_mx_sm_state_disc_wait_ua (p_mcb, event, p_data); break; + default: + RFCOMM_TRACE_DEBUG("invalid state:%d\n", p_mcb->state); + break; } } @@ -215,7 +218,7 @@ void rfc_mx_sm_state_wait_conn_cnf (tRFC_MCB *p_mcb, UINT16 event, void *p_data) return; /* There is some new timing so that Config Ind comes before security is completed - so we are still waiting fo the confirmation. */ + so we are still waiting for the confirmation. */ case RFC_MX_EVENT_CONF_IND: rfc_mx_conf_ind (p_mcb, (tL2CAP_CFG_INFO *)p_data); return; diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c index 8d8fe3cac66..aef37b6120b 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c @@ -62,13 +62,13 @@ static void rfc_set_port_state(tPORT_STATE *port_pars, MX_FRAME *p_frame); *******************************************************************************/ void rfc_port_sm_execute (tPORT *p_port, UINT16 event, void *p_data) { - RFCOMM_TRACE_DEBUG("%s st:%d, evt:%d\n", __func__, p_port->rfc.state, event); - if (!p_port) { RFCOMM_TRACE_WARNING ("NULL port event %d", event); return; } + RFCOMM_TRACE_DEBUG("%s st:%d, evt:%d\n", __func__, p_port->rfc.state, event); + switch (p_port->rfc.state) { case RFC_STATE_CLOSED: rfc_port_sm_state_closed (p_port, event, p_data); @@ -240,7 +240,7 @@ void rfc_port_sm_sabme_wait_ua (tPORT *p_port, UINT16 event, void *p_data) ** ** Description This function handles events for the port in the ** WAIT_SEC_CHECK state. SABME has been received from the -** peer and Security Manager verifes BD_ADDR, before we can +** peer and Security Manager verifies BD_ADDR, before we can ** send ESTABLISH_IND to the Port entity ** ** Returns void @@ -597,8 +597,7 @@ void rfc_process_rpn (tRFC_MCB *p_mcb, BOOLEAN is_command, } /* If we are not awaiting response just ignore it */ - p_port = port_find_mcb_dlci_port (p_mcb, p_frame->dlci); - if ((p_port == NULL) || !(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) { + if (!(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) { return; } diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c index 6968de81b17..06f34331719 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c @@ -359,7 +359,7 @@ void RFCOMM_LineStatusReq (tRFC_MCB *p_mcb, UINT8 dlci, UINT8 status) *******************************************************************************/ void RFCOMM_DlcReleaseReq (tRFC_MCB *p_mcb, UINT8 dlci) { - rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, 0); + rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, NULL); } diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c index 2d06823173f..1a715893d3b 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c @@ -179,8 +179,17 @@ void rfc_send_buf_uih (tRFC_MCB *p_mcb, UINT8 dlci, BT_HDR *p_buf) UINT8 cr = RFCOMM_CR(p_mcb->is_initiator, TRUE); UINT8 credits; + if (p_buf->offset < RFCOMM_CTRL_FRAME_LEN) { + osi_free(p_buf); + return; + } + p_buf->offset -= RFCOMM_CTRL_FRAME_LEN; if (p_buf->len > 127) { + if (p_buf->offset < 1) { + osi_free(p_buf); + return; + } p_buf->offset--; } @@ -191,6 +200,10 @@ void rfc_send_buf_uih (tRFC_MCB *p_mcb, UINT8 dlci, BT_HDR *p_buf) } if (credits) { + if (p_buf->offset < 1) { + osi_free(p_buf); + return; + } p_buf->offset--; } @@ -514,16 +527,12 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr) UINT8 dlci; BOOLEAN get_dlci = FALSE; tPORT *p_port; - tPORT_CTRL *p_pars; + tPORT_CTRL pars; tRFC_MCB *p_mcb; - if ((p_pars = (tPORT_CTRL *)osi_malloc(sizeof(tPORT_CTRL))) == NULL) { - return; - } - - p_pars->modem_signal = 0; - p_pars->break_signal = 0; - p_pars->fc = TRUE; + pars.modem_signal = 0; + pars.break_signal = 0; + pars.fc = TRUE; p_mcb = port_find_mcb (cert_pts_addr); @@ -536,12 +545,11 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr) } } - if (get_dlci) { - rfc_send_msc(p_mcb, dlci, TRUE, p_pars); + if (get_dlci && p_mcb) { + rfc_send_msc(p_mcb, dlci, TRUE, &pars); } else { RFCOMM_TRACE_ERROR ("Get dlci fail"); } - osi_free(p_pars); } #endif /* BT_RFCOMM_BQB_INCLUDED */ @@ -558,8 +566,26 @@ void rfc_send_test (tRFC_MCB *p_mcb, BOOLEAN is_command, BT_HDR *p_buf) UINT16 xx; UINT8 *p_src, *p_dest; + if (p_buf->offset + sizeof(BT_HDR) >= RFCOMM_CMD_BUF_SIZE) { + osi_free(p_buf); + return; + } + + UINT16 max_len = RFCOMM_CMD_BUF_SIZE - sizeof(BT_HDR) - p_buf->offset; + if (p_buf->offset < (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2)) { + if (max_len < (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2 - p_buf->offset)) { + osi_free(p_buf); + return; + } + max_len -= (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2 - p_buf->offset); + } + if (p_buf->len > max_len) { + p_buf->len = max_len; + } + BT_HDR *p_buf_new; if ((p_buf_new = (BT_HDR *)osi_malloc(RFCOMM_CMD_BUF_SIZE)) == NULL) { + osi_free(p_buf); return; } memcpy(p_buf_new, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len); @@ -763,7 +789,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf) RFCOMM_TRACE_ERROR("Illegal MX Frame len:%d < 2", length); osi_free(p_buf); return; - } + } p_rx_frame->ea = *p_data & RFCOMM_EA; p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR; @@ -960,7 +986,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf) if (!ea || !cr || !p_rx_frame->dlci || !RFCOMM_VALID_DLCI (p_rx_frame->dlci)) { - RFCOMM_TRACE_ERROR ("Bad RPN frame"); + RFCOMM_TRACE_ERROR ("Bad RLS frame"); break; } diff --git a/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c b/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c index b766918d0e8..d3ad4ea7d97 100644 --- a/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c +++ b/components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c @@ -121,6 +121,10 @@ BOOLEAN rfc_check_fcs (UINT16 len, UINT8 *p, UINT8 received_fcs) return (fcs == 0xCF); } +void osi_free_fun(void *p) +{ + osi_free(p); +} /******************************************************************************* ** @@ -168,7 +172,7 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator) p_mcb = &rfc_cb.port.rfc_mcb[j]; if (rfc_cb.port.rfc_mcb[j].state == RFC_MX_STATE_IDLE) { /* New multiplexer control block */ - fixed_queue_free(p_mcb->cmd_q, NULL); + fixed_queue_free(p_mcb->cmd_q, osi_free_fun); rfc_timer_free(p_mcb); memset (p_mcb, 0, sizeof (tRFC_MCB)); memcpy (p_mcb->bd_addr, bd_addr, BD_ADDR_LEN); @@ -188,15 +192,11 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator) return (NULL); } -void osi_free_fun(void *p) -{ - osi_free(p); -} /******************************************************************************* ** ** Function rfc_release_multiplexer_channel ** -** Description This function returns existing or new control block for +** Description This function releases existing control block for ** the BD_ADDR. ** *******************************************************************************/ @@ -299,7 +299,7 @@ void rfc_port_timer_stop (tPORT *p_port) *******************************************************************************/ void rfc_port_timer_free (tPORT *p_port) { - RFCOMM_TRACE_EVENT ("rfc_port_timer_stop"); + RFCOMM_TRACE_EVENT ("rfc_port_timer_free"); btu_free_timer (&p_port->rfc.tle); memset(&p_port->rfc.tle, 0, sizeof(TIMER_LIST_ENT)); @@ -491,18 +491,21 @@ void rfc_check_send_cmd(tRFC_MCB *p_mcb, BT_HDR *p_buf) RFCOMM_TRACE_ERROR("%s: empty queue: p_mcb = %p p_mcb->lcid = %u cached p_mcb = %p", __func__, p_mcb, p_mcb->lcid, rfc_find_lcid_mcb(p_mcb->lcid)); + osi_free(p_buf); + } else { + fixed_queue_enqueue(p_mcb->cmd_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT); } - fixed_queue_enqueue(p_mcb->cmd_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT); } /* handle queue if L2CAP not congested */ - while (p_mcb->l2cap_congested == FALSE) { - if ((p = (BT_HDR *)fixed_queue_dequeue(p_mcb->cmd_q, 0)) == NULL) { - break; + if (p_mcb->cmd_q) { + while (p_mcb->l2cap_congested == FALSE) { + if ((p = (BT_HDR *)fixed_queue_dequeue(p_mcb->cmd_q, 0)) == NULL) { + break; + } + + L2CA_DataWrite (p_mcb->lcid, p); } - - - L2CA_DataWrite (p_mcb->lcid, p); } } diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_api.c b/components/bt/host/bluedroid/stack/sdp/sdp_api.c index 1321c4108a3..30d08367388 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_api.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_api.c @@ -72,8 +72,8 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui /* verify the parameters */ if (p_db == NULL || (sizeof (tSDP_DISCOVERY_DB) > len) || num_attr > SDP_MAX_ATTR_FILTERS || num_uuid > SDP_MAX_UUID_FILTERS) { - SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db 0x%x, len %d, num_uuid %d, num_attr %d", - (UINT32)p_db, len, num_uuid, num_attr); + SDP_TRACE_ERROR("SDP_InitDiscoveryDb Illegal param: p_db %p, len %d, num_uuid %d, num_attr %d", + p_db, len, num_uuid, num_attr); return (FALSE); } @@ -99,8 +99,9 @@ BOOLEAN SDP_InitDiscoveryDb (tSDP_DISCOVERY_DB *p_db, UINT32 len, UINT16 num_uui sdpu_sort_attr_list( num_attr, p_db ); p_db->num_attr_filters = num_attr; -#endif return (TRUE); +#endif + return (FALSE); } @@ -124,8 +125,9 @@ BOOLEAN SDP_CancelServiceSearch (tSDP_DISCOVERY_DB *p_db) sdp_disconnect (p_ccb, SDP_CANCEL); p_ccb->disc_state = SDP_DISC_WAIT_CANCEL; -#endif return (TRUE); +#endif + return (FALSE); } @@ -429,7 +431,7 @@ BOOLEAN SDP_FindServiceUUIDInRec_128bit(tSDP_DISC_REC *p_rec, tBT_UUID *p_uuid) for (p_sattr = p_attr->attr_value.v.p_sub_attr; p_sattr; p_sattr = p_sattr->p_next_attr) { if (SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UUID_DESC_TYPE) { /* only support 128 bits UUID for now */ - if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 16) { + if (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == LEN_UUID_128) { p_uuid->len = LEN_UUID_128; for (uint8_t i = 0; i != LEN_UUID_128; ++i) { p_uuid->uu.uuid128[i] = p_sattr->attr_value.v.array[LEN_UUID_128 - i - 1]; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_db.c b/components/bt/host/bluedroid/stack/sdp/sdp_db.c index 06f934d4a3a..88d84071d0b 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_db.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_db.c @@ -68,15 +68,15 @@ tSDP_RECORD *sdp_db_service_search (tSDP_RECORD *p_rec, tSDP_UUID_SEQ *p_seq) /* If NULL, start at the beginning, else start at the first specified record */ if (!p_rec) { - p_node = list_begin(sdp_cb.server_db.p_record_list); + p_node = list_begin(sdp_cb.server_db.p_record_list); } else { - /* get node in the record list with given p_rec */ + /* get node in the record list with given p_rec */ p_node = list_get_node(sdp_cb.server_db.p_record_list, p_rec); - if (p_node == NULL) { - return NULL; - } - /* get next node */ - p_node = list_next(p_node); + if (p_node == NULL) { + return NULL; + } + /* get next node */ + p_node = list_next(p_node); } /* Look through the records. The spec says that a match occurs if */ @@ -178,8 +178,8 @@ tSDP_RECORD *sdp_db_find_record (UINT32 handle) /* Look through the records for the caller's handle */ for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - p_rec = list_node(p_node); - if (p_rec->record_handle == handle) { + p_rec = list_node(p_node); + if (p_rec->record_handle == handle) { return (p_rec); } } @@ -360,9 +360,7 @@ BOOLEAN SDP_DeleteRecord (UINT32 handle) if (handle == 0 || sdp_cb.server_db.num_records == 0) { /* Delete all records in the database */ sdp_cb.server_db.num_records = 0; - for (p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - list_remove(sdp_cb.server_db.p_record_list, p_node); - } + list_clear(sdp_cb.server_db.p_record_list); /* require new DI record to be created in SDP_SetLocalDiRecord */ sdp_cb.server_db.di_primary_handle = 0; @@ -448,7 +446,7 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type, /* Find the record in the database */ for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - p_rec= list_node(p_node); + p_rec= list_node(p_node); if (p_rec->record_handle == handle) { tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0]; @@ -488,27 +486,24 @@ BOOLEAN SDP_AddAttribute (UINT32 handle, UINT16 attr_id, UINT8 attr_type, p_attr->type = attr_type; p_attr->len = attr_len; - if (p_rec->free_pad_ptr + attr_len >= SDP_MAX_PAD_LEN) { + if (p_rec->free_pad_ptr + attr_len > SDP_MAX_PAD_LEN) { /* do truncate only for text string type descriptor */ if (attr_type == TEXT_STR_DESC_TYPE) { SDP_TRACE_WARNING("SDP_AddAttribute: attr_len:%d too long. truncate to (%d)\n", attr_len, SDP_MAX_PAD_LEN - p_rec->free_pad_ptr ); attr_len = SDP_MAX_PAD_LEN - p_rec->free_pad_ptr; - p_val[SDP_MAX_PAD_LEN - p_rec->free_pad_ptr] = '\0'; - p_val[SDP_MAX_PAD_LEN - p_rec->free_pad_ptr + 1] = '\0'; } else { attr_len = 0; } } - if ((attr_len > 0) && (p_val != 0)) { + if (attr_len > 0) { p_attr->len = attr_len; memcpy (&p_rec->attr_pad[p_rec->free_pad_ptr], p_val, (size_t)attr_len); p_attr->value_ptr = &p_rec->attr_pad[p_rec->free_pad_ptr]; p_rec->free_pad_ptr += attr_len; - } else if ((attr_len == 0 && p_attr->len != 0) || /* if truncate to 0 length, simply don't add */ - p_val == 0) { + } else if (attr_len == 0 && p_attr->len != 0) { /* if truncate to 0 length, simply don't add */ SDP_TRACE_ERROR("SDP_AddAttribute fail, length exceed maximum: ID %d: attr_len:%d \n", attr_id, attr_len ); p_attr->id = p_attr->type = p_attr->len = 0; @@ -893,7 +888,7 @@ BOOLEAN SDP_DeleteAttribute (UINT32 handle, UINT16 attr_id) /* Find the record in the database */ for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) { - p_rec= list_node(p_node); + p_rec= list_node(p_node); if (p_rec->record_handle == handle) { tSDP_ATTRIBUTE *p_attr = &p_rec->attribute[0]; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c b/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c index 82ef1548da3..dc311d8a635 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c @@ -90,7 +90,7 @@ static UINT8 *sdpu_build_uuid_seq (UINT8 *p_out, UINT16 num_uuids, tSDP_UUID *p_ UINT32_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid32); } else { UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES); - ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, p_uuid_list->len); + ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, LEN_UUID_128); } } @@ -305,6 +305,9 @@ static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT8 * if (p_ccb->num_handles > sdp_cb.max_recs_per_search) { p_ccb->num_handles = sdp_cb.max_recs_per_search; } + if (p_ccb->num_handles > SDP_MAX_DISC_SERVER_RECS) { + p_ccb->num_handles = SDP_MAX_DISC_SERVER_RECS; + } if (p_reply + ((p_ccb->num_handles - orig) * 4) + 1 > p_reply_end) { sdp_disconnect(p_ccb, SDP_GENERIC_ERROR); @@ -371,6 +374,10 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset) p = &p_ccb->rsp_list[0]; p_end = &p_ccb->rsp_list[0] + list_len; + if (cpy_len == 0) { + return; + } + if (offset) { type = *p++; cpy_len--; @@ -424,8 +431,10 @@ static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT8 *p_ /* If p_reply is NULL, we were called after the records handles were read */ if (p_reply) { #if (SDP_DEBUG_RAW == TRUE) - SDP_TRACE_WARNING("ID & len: 0x%02x-%02x-%02x-%02x\n", - p_reply[0], p_reply[1], p_reply[2], p_reply[3]); + if (p_reply + 4 <= p_reply_end) { + SDP_TRACE_WARNING("ID & len: 0x%02x-%02x-%02x-%02x\n", + p_reply[0], p_reply[1], p_reply[2], p_reply[3]); + } #endif /* Skip transaction ID and length */ p_reply += 4; @@ -830,7 +839,7 @@ static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end) ** Returns pointer to next byte in data stream ** *******************************************************************************/ -tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda) +static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda) { tSDP_DISC_REC *p_rec; @@ -945,7 +954,7 @@ static UINT8 *add_attr (UINT8 *p, UINT8 *p_end, tSDP_DISCOVERY_DB *p_db, tSDP_DI break; } } - /* Case falls through */ + /* falls through */ case TWO_COMP_INT_DESC_TYPE: switch (attr_len) { diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_main.c b/components/bt/host/bluedroid/stack/sdp/sdp_main.c index e945314b830..11309caec38 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_main.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_main.c @@ -28,7 +28,6 @@ #include "common/bt_target.h" #include "osi/allocator.h" -#include "stack/l2cdefs.h" #include "stack/hcidefs.h" #include "stack/hcimsgs.h" @@ -138,6 +137,10 @@ void sdp_init (void) { #if SDP_DYNAMIC_MEMORY sdp_cb_ptr = (tSDP_CB *)osi_malloc(sizeof(tSDP_CB)); + if (!sdp_cb_ptr) { + ESP_LOGE("BT_SDP", "SDP control block malloc failed\n"); + return; + } #endif /* #if SDP_DYNAMIC_MEMORY */ /* Clears all structures and local SDP database (if Server is enabled) */ memset (&sdp_cb, 0, sizeof (tSDP_CB)); @@ -208,8 +211,10 @@ void sdp_deinit (void) { list_free(sdp_cb.server_db.p_record_list); #if SDP_DYNAMIC_MEMORY - osi_free(sdp_cb_ptr); - sdp_cb_ptr = NULL; + if (sdp_cb_ptr) { + osi_free(sdp_cb_ptr); + sdp_cb_ptr = NULL; + } #endif /* #if SDP_DYNAMIC_MEMORY */ } @@ -403,7 +408,7 @@ static void sdp_config_ind (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg) p_cfg->mtu_present = FALSE; p_cfg->result = L2CAP_CFG_OK; - /* Check peer config request against our rfcomm configuration */ + /* Check peer config request against our sdp configuration */ if (p_cfg->fcr_present) { /* Reject the window size if it is bigger than we want it to be */ if (p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE) { diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_server.c b/components/bt/host/bluedroid/stack/sdp/sdp_server.c index d36b4115c94..645e175ea5f 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_server.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_server.c @@ -226,7 +226,7 @@ static void process_service_search (tCONN_CB *p_ccb, UINT16 trans_num, return; } if (*p_req) { - if (*p_req++ != SDP_CONTINUATION_LEN || (p_req >= p_req_end)) { + if (*p_req++ != SDP_CONTINUATION_LEN || (p_req + 2 > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN); return; @@ -344,13 +344,18 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, max_list_len = p_ccb->rem_mtu_size - SDP_MAX_ATTR_RSPHDR_LEN; } - p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq); + p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq); if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST); return; } + if (max_list_len < 4) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL); + return; + } + memcpy(&attr_seq_sav, &attr_seq, sizeof(tSDP_ATTR_SEQ)) ; /* Find a record with the record handle */ @@ -375,31 +380,32 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, p_ccb->rsp_list = (UINT8 *)osi_malloc(max_list_len); if (p_ccb->rsp_list == NULL) { SDP_TRACE_ERROR("%s No scratch buf for attr rsp\n", __func__); + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); return; } if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } BE_STREAM_TO_UINT16 (cont_offset, p_req); if (cont_offset != p_ccb->cont_offset) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } - if (!p_ccb->rsp_list) { - sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); - return; - } is_cont = TRUE; /* Initialise for continuation response */ p_rsp = &p_ccb->rsp_list[0]; attr_seq.attr_entry[p_ccb->cont_info.next_attr_index].start = p_ccb->cont_info.next_attr_start_id; } else { - if (p_ccb->rsp_list) { + if (p_ccb->rsp_list) { osi_free (p_ccb->rsp_list); } @@ -438,6 +444,12 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (p_ccb->cont_info.attr_offset) { p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } /* If the partial attrib could not been fully added yet */ if (p_ccb->cont_info.attr_offset != attr_len) { @@ -449,12 +461,20 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (attr_len >= SDP_MAX_ATTR_LEN) { SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len); sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } /* add the partial attribute if possible */ p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } p_ccb->cont_info.next_attr_index = xx; p_ccb->cont_info.next_attr_start_id = p_attr->id; @@ -502,6 +522,8 @@ static void process_service_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* Get a buffer to use to build the response */ if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } p_buf->offset = L2CAP_MIN_OFFSET; @@ -574,7 +596,6 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, BOOLEAN maxxed_out = FALSE, is_cont = FALSE; UINT8 *p_seq_start; UINT16 seq_len, attr_len; - UNUSED(p_req_end); /* Extract the UUID sequence to search for */ p_req = sdpu_extract_uid_seq (p_req, param_len, &uid_seq); @@ -591,9 +612,9 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, max_list_len = p_ccb->rem_mtu_size - SDP_MAX_SERVATTR_RSPHDR_LEN; } - p_req = sdpu_extract_attr_seq (p_req, param_len, &attr_seq); + p_req = sdpu_extract_attr_seq (p_req, (UINT16)(p_req_end - p_req), &attr_seq); - if ((!p_req) || (!attr_seq.num_attr)) { + if ((!p_req) || (!attr_seq.num_attr) || (p_req > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX, SDP_TEXT_BAD_ATTR_LIST); return; } @@ -625,17 +646,23 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if ((*p_req++ != SDP_CONTINUATION_LEN) || (p_req + 2 > p_req_end)) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_LEN); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } BE_STREAM_TO_UINT16 (cont_offset, p_req); if (cont_offset != p_ccb->cont_offset) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_INVALID_CONT_STATE, SDP_TEXT_BAD_CONT_INX); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } if (!p_ccb->rsp_list) { sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } is_cont = TRUE; @@ -704,6 +731,12 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (p_ccb->cont_info.attr_offset) { p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } /* If the partial attrib could not been fully added yet */ if (p_ccb->cont_info.attr_offset != attr_len) { @@ -716,12 +749,20 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, if (attr_len >= SDP_MAX_ATTR_LEN) { SDP_TRACE_ERROR("SDP attr too big: max_list_len=%d,attr_len=%d\n", max_list_len, attr_len); sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } /* add the partial attribute if possible */ p_rsp = sdpu_build_partial_attrib_entry (p_rsp, p_attr, (UINT16)rem_len, &p_ccb->cont_info.attr_offset); + if (p_rsp == NULL) { + sdpu_build_n_send_error (p_ccb, trans_num, SDP_NO_RESOURCES, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; + return; + } p_ccb->cont_info.next_attr_index = xx; p_ccb->cont_info.next_attr_start_id = p_attr->id; @@ -791,6 +832,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, // TODO(sharvil): rewrite SDP server. if (is_cont && len_to_send == 0) { sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE, NULL); + osi_free(p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } @@ -817,6 +860,8 @@ static void process_service_search_attr_req (tCONN_CB *p_ccb, UINT16 trans_num, /* Get a buffer to use to build the response */ if ((p_buf = (BT_HDR *)osi_malloc(SDP_DATA_BUF_SIZE)) == NULL) { SDP_TRACE_ERROR ("SDP - no buf for search rsp\n"); + osi_free (p_ccb->rsp_list); + p_ccb->rsp_list = NULL; return; } p_buf->offset = L2CAP_MIN_OFFSET; diff --git a/components/bt/host/bluedroid/stack/sdp/sdp_utils.c b/components/bt/host/bluedroid/stack/sdp/sdp_utils.c index f354ea3ad35..4ded1162707 100644 --- a/components/bt/host/bluedroid/stack/sdp/sdp_utils.c +++ b/components/bt/host/bluedroid/stack/sdp/sdp_utils.c @@ -361,6 +361,8 @@ void sdpu_build_n_send_error (tCONN_CB *p_ccb, UINT16 trans_num, UINT16 error_co UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) { UINT8 *p_seq_end; + UINT8 *p_param_start; + UINT8 *p_param_end; UINT8 descr, type, size; UINT32 seq_len, uuid_len; @@ -368,7 +370,12 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) p_seq->num_uids = 0; /* A UID sequence is composed of a bunch of UIDs. */ + p_param_start = p; + p_param_end = p_param_start + param_len; + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -388,26 +395,38 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) seq_len = 16; break; case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (seq_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT16 (seq_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT32 (seq_len, p); break; default: return (NULL); } - if (seq_len >= param_len) { + p_seq_end = p + seq_len; + if (p_seq_end < p || p_seq_end > p_param_end) { return (NULL); } - p_seq_end = p + seq_len; - /* Loop through, extracting the UIDs */ for ( ; p < p_seq_end ; ) { + if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) { + return (NULL); + } + BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -427,31 +446,37 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) uuid_len = 16; break; case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_seq_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (uuid_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_seq_end) { + return (NULL); + } BE_STREAM_TO_UINT16 (uuid_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_seq_end) { + return (NULL); + } BE_STREAM_TO_UINT32 (uuid_len, p); break; default: return (NULL); } - /* If UUID length is valid, copy it across */ - if ((uuid_len == 2) || (uuid_len == 4) || (uuid_len == 16)) { - p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len; - BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len); - p_seq->num_uids++; - } else { + if ((uuid_len != 2) && (uuid_len != 4) && (uuid_len != 16)) { + return (NULL); + } + if (p + uuid_len > p_seq_end) { return (NULL); } - /* We can only do so many */ - if (p_seq->num_uids >= MAX_UUIDS_PER_SEQ) { - return (NULL); - } + p_seq->uuid_entry[p_seq->num_uids].len = (UINT16) uuid_len; + BE_STREAM_TO_ARRAY (p, p_seq->uuid_entry[p_seq->num_uids].value, (int)uuid_len); + p_seq->num_uids++; } if (p != p_seq_end) { @@ -476,13 +501,22 @@ UINT8 *sdpu_extract_uid_seq (UINT8 *p, UINT16 param_len, tSDP_UUID_SEQ *p_seq) UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) { UINT8 *p_end_list; + UINT8 *p_param_start; + UINT8 *p_param_end; UINT8 descr, type, size; UINT32 list_len, attr_len; /* Assume none found */ p_seq->num_attr = 0; + /* param_len is bytes available from p through end of SDP parameter block */ + p_param_start = p; + p_param_end = p_param_start + param_len; + /* Get attribute sequence info */ + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -493,14 +527,23 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) switch (size) { case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT8 (list_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT16 (list_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_param_end) { + return (NULL); + } BE_STREAM_TO_UINT32 (list_len, p); break; @@ -508,14 +551,17 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) return (p); } - if (list_len > param_len) { - return (p); - } - p_end_list = p + list_len; + if (p_end_list < p || p_end_list > p_param_end) { + return (NULL); + } /* Loop through, extracting the attribute IDs */ for ( ; p < p_end_list ; ) { + if (p_seq->num_attr >= MAX_ATTR_PER_SEQ) { + return (NULL); + } + BE_STREAM_TO_UINT8 (descr, p); type = descr >> 3; size = descr & 7; @@ -532,34 +578,45 @@ UINT8 *sdpu_extract_attr_seq (UINT8 *p, UINT16 param_len, tSDP_ATTR_SEQ *p_seq) attr_len = 4; break; case SIZE_IN_NEXT_BYTE: + if (p + 1 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT8 (attr_len, p); break; case SIZE_IN_NEXT_WORD: + if (p + 2 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT16 (attr_len, p); break; case SIZE_IN_NEXT_LONG: + if (p + 4 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT32 (attr_len, p); break; default: return (NULL); - break; } /* Attribute length must be 2-bytes or 4-bytes for a paired entry. */ if (attr_len == 2) { + if (p + 2 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p); p_seq->attr_entry[p_seq->num_attr].end = p_seq->attr_entry[p_seq->num_attr].start; } else if (attr_len == 4) { + if (p + 4 > p_end_list) { + return (NULL); + } BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].start, p); BE_STREAM_TO_UINT16 (p_seq->attr_entry[p_seq->num_attr].end, p); } else { return (NULL); } - /* We can only do so many */ - if (++p_seq->num_attr >= MAX_ATTR_PER_SEQ) { - return (NULL); - } + p_seq->num_attr++; } return (p); @@ -995,6 +1052,25 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI UINT8 *p_tmp_attr; size_t len_to_copy; UINT16 attr_len; + UINT16 rem_in_attr; + + attr_len = sdpu_get_attrib_entry_len(p_attr); + if (attr_len > SDP_MAX_ATTR_LEN) { + SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: attr_len %u exceeds SDP_MAX_ATTR_LEN %u\n", + attr_len, (UINT16)SDP_MAX_ATTR_LEN); + return NULL; + } + if (*offset > attr_len) { + SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry: offset %u past attr_len %u\n", *offset, attr_len); + return NULL; + } + + rem_in_attr = (UINT16)(attr_len - *offset); + len_to_copy = (size_t)((rem_in_attr < len) ? rem_in_attr : len); + /* rem_in_attr is 0 when *offset == attr_len; avoid memcpy(0) issues and useless work */ + if (len_to_copy == 0) { + return p_out; + } if ((p_attr_buff = (UINT8 *) osi_malloc(sizeof(UINT8) * SDP_MAX_ATTR_LEN )) == NULL) { SDP_TRACE_ERROR("sdpu_build_partial_attrib_entry cannot get a buffer!\n"); @@ -1003,14 +1079,11 @@ UINT8 *sdpu_build_partial_attrib_entry (UINT8 *p_out, tSDP_ATTRIBUTE *p_attr, UI p_tmp_attr = p_attr_buff; sdpu_build_attrib_entry(p_tmp_attr, p_attr); - attr_len = sdpu_get_attrib_entry_len(p_attr); - - len_to_copy = ((attr_len - *offset) < len) ? (attr_len - *offset) : len; memcpy(p_out, &p_attr_buff[*offset], len_to_copy); p_out = &p_out[len_to_copy]; - *offset += len_to_copy; + *offset += (UINT16)len_to_copy; osi_free(p_attr_buff); return p_out; diff --git a/components/bt/host/bluedroid/stack/smp/smp_br_main.c b/components/bt/host/bluedroid/stack/smp/smp_br_main.c index 5ef7a7c694e..cf477897348 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_br_main.c +++ b/components/bt/host/bluedroid/stack/smp/smp_br_main.c @@ -37,7 +37,7 @@ const char *const smp_br_event_name [SMP_BR_MAX_EVT] = { "BR_CONFIRM_EVT", "BR_RAND_EVT", "BR_PAIRING_FAILED_EVT", - "BR_ENCRPTION_INFO_EVT", + "BR_ENCRYPTION_INFO_EVT", "BR_MASTER_ID_EVT", "BR_ID_INFO_EVT", "BR_ID_ADDR_EVT", @@ -316,7 +316,13 @@ void smp_br_state_machine_event(tSMP_CB *p_cb, tSMP_BR_EVENT event, void *p_data tSMP_BR_STATE curr_state = p_cb->br_state; tSMP_BR_SM_TBL state_table; UINT8 action, entry; - tSMP_BR_ENTRY_TBL entry_table = smp_br_entry_table[p_cb->role]; + tSMP_BR_ENTRY_TBL entry_table = NULL; + + if (p_cb->role > HCI_ROLE_SLAVE) { + SMP_TRACE_ERROR("Invalid role: %d", p_cb->role); + return; + } + entry_table = smp_br_entry_table[p_cb->role]; SMP_TRACE_EVENT("main %s", __func__); if (curr_state >= SMP_BR_STATE_MAX) {