Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in SPP

Browse Source
This commit is contained in:
Jin Cheng
2026-05-09 11:13:38 +08:00
committed by Jin Cheng
parent 6d262a0474
commit eb1c77472a
8 changed files with 93 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c
+3 -3
View File
@@ -62,13 +62,13 @@ static void rfc_set_port_state(tPORT_STATE *port_pars, MX_FRAME *p_frame);
*******************************************************************************/
void rfc_port_sm_execute (tPORT *p_port, UINT16 event, void *p_data)
{
RFCOMM_TRACE_DEBUG("%s st:%d, evt:%d\n", __func__, p_port->rfc.state, event);
if (!p_port) {
RFCOMM_TRACE_WARNING ("NULL port event %d", event);
return;
}
RFCOMM_TRACE_DEBUG("%s st:%d, evt:%d\n", __func__, p_port->rfc.state, event);
switch (p_port->rfc.state) {
case RFC_STATE_CLOSED:
rfc_port_sm_state_closed (p_port, event, p_data);
@@ -240,7 +240,7 @@ void rfc_port_sm_sabme_wait_ua (tPORT *p_port, UINT16 event, void *p_data)
**
** Description This function handles events for the port in the
** WAIT_SEC_CHECK state. SABME has been received from the
** peer and Security Manager verifes BD_ADDR, before we can
** peer and Security Manager verifies BD_ADDR, before we can
** send ESTABLISH_IND to the Port entity
**
** Returns void
components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c
+31
View File
@@ -179,8 +179,17 @@ void rfc_send_buf_uih (tRFC_MCB *p_mcb, UINT8 dlci, BT_HDR *p_buf)
UINT8 cr = RFCOMM_CR(p_mcb->is_initiator, TRUE);
UINT8 credits;
if (p_buf->offset < RFCOMM_CTRL_FRAME_LEN) {
osi_free(p_buf);
return;
}
p_buf->offset -= RFCOMM_CTRL_FRAME_LEN;
if (p_buf->len > 127) {
if (p_buf->offset < 1) {
osi_free(p_buf);
return;
}
p_buf->offset--;
}
@@ -191,6 +200,10 @@ void rfc_send_buf_uih (tRFC_MCB *p_mcb, UINT8 dlci, BT_HDR *p_buf)
}
if (credits) {
if (p_buf->offset < 1) {
osi_free(p_buf);
return;
}
p_buf->offset--;
}
@@ -558,8 +571,26 @@ void rfc_send_test (tRFC_MCB *p_mcb, BOOLEAN is_command, BT_HDR *p_buf)
UINT16 xx;
UINT8 *p_src, *p_dest;
if (p_buf->offset + sizeof(BT_HDR) >= RFCOMM_CMD_BUF_SIZE) {
osi_free(p_buf);
return;
}
UINT16 max_len = RFCOMM_CMD_BUF_SIZE - sizeof(BT_HDR) - p_buf->offset;
if (p_buf->offset < (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2)) {
if (max_len < (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2 - p_buf->offset)) {
osi_free(p_buf);
return;
}
max_len -= (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2 - p_buf->offset);
}
if (p_buf->len > max_len) {
p_buf->len = max_len;
}
BT_HDR *p_buf_new;
if ((p_buf_new = (BT_HDR *)osi_malloc(RFCOMM_CMD_BUF_SIZE)) == NULL) {
osi_free(p_buf);
return;
}
memcpy(p_buf_new, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);
components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c
+10 -7
View File
@@ -491,18 +491,21 @@ void rfc_check_send_cmd(tRFC_MCB *p_mcb, BT_HDR *p_buf)
RFCOMM_TRACE_ERROR("%s: empty queue: p_mcb = %p p_mcb->lcid = %u cached p_mcb = %p",
__func__, p_mcb, p_mcb->lcid,
rfc_find_lcid_mcb(p_mcb->lcid));
osi_free(p_buf);
} else {
fixed_queue_enqueue(p_mcb->cmd_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
}
fixed_queue_enqueue(p_mcb->cmd_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
}
/* handle queue if L2CAP not congested */
while (p_mcb->l2cap_congested == FALSE) {
if ((p = (BT_HDR *)fixed_queue_dequeue(p_mcb->cmd_q, 0)) == NULL) {
break;
if (p_mcb->cmd_q) {
while (p_mcb->l2cap_congested == FALSE) {
if ((p = (BT_HDR *)fixed_queue_dequeue(p_mcb->cmd_q, 0)) == NULL) {
break;
}
L2CA_DataWrite (p_mcb->lcid, p);
}
L2CA_DataWrite (p_mcb->lcid, p);
}
}