Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed the vulerabilities from AI code review in SPP

Browse Source
This commit is contained in:
Jin Cheng
2026-03-30 17:38:46 +08:00
parent 2839dacbc2
commit ed270d71c8
17 changed files with 133 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/rfcomm/port_api.c
+6 -2
View File
@@ -114,7 +114,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server,
RFCOMM_TRACE_API ("RFCOMM_CreateConnection() BDA: %02x-%02x-%02x-%02x-%02x-%02x",
bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4], bd_addr[5]);
*p_handle = 0;
if (p_handle) {
*p_handle = 0;
}
if (( scn == 0 ) || (scn >= PORT_MAX_RFC_PORTS )) {
/* Server Channel Number(SCN) should be in range 1...30 */
@@ -170,7 +172,9 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server,
RFCOMM_TRACE_EVENT ("RFCOMM_CreateConnection dlci:%d signal state:0x%x", dlci, p_port->default_signal_state);
*p_handle = p_port->inx;
if (p_handle) {
*p_handle = p_port->inx;
}
p_port->state = PORT_STATE_OPENING;
p_port->uuid = uuid;
components/bt/host/bluedroid/stack/rfcomm/rfc_l2cap_if.c
+1 -1
View File
@@ -421,7 +421,7 @@ tRFC_MCB *rfc_find_lcid_mcb (UINT16 lcid)
**
** Function rfc_save_lcid_mcb
**
** Description This function returns MCB block supporting local cid
** Description This function saves MCB block supporting local cid
**
*******************************************************************************/
void rfc_save_lcid_mcb (tRFC_MCB *p_mcb, UINT16 lcid)
components/bt/host/bluedroid/stack/rfcomm/rfc_mx_fsm.c
+4 -1
View File
@@ -119,6 +119,9 @@ void rfc_mx_sm_execute (tRFC_MCB *p_mcb, UINT16 event, void *p_data)
rfc_mx_sm_state_disc_wait_ua (p_mcb, event, p_data);
break;
default:
RFCOMM_TRACE_DEBUG("invalid state:%d\n", p_mcb->state);
break;
}
}
@@ -215,7 +218,7 @@ void rfc_mx_sm_state_wait_conn_cnf (tRFC_MCB *p_mcb, UINT16 event, void *p_data)
return;
/* There is some new timing so that Config Ind comes before security is completed
so we are still waiting fo the confirmation. */
so we are still waiting for the confirmation. */
case RFC_MX_EVENT_CONF_IND:
rfc_mx_conf_ind (p_mcb, (tL2CAP_CFG_INFO *)p_data);
return;
components/bt/host/bluedroid/stack/rfcomm/rfc_port_fsm.c
+1 -2
View File
@@ -597,8 +597,7 @@ void rfc_process_rpn (tRFC_MCB *p_mcb, BOOLEAN is_command,
}
/* If we are not awaiting response just ignore it */
p_port = port_find_mcb_dlci_port (p_mcb, p_frame->dlci);
if ((p_port == NULL) || !(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) {
if (!(p_port->rfc.expected_rsp & (RFC_RSP_RPN | RFC_RSP_RPN_REPLY))) {
return;
}
components/bt/host/bluedroid/stack/rfcomm/rfc_port_if.c
+1 -1
View File
@@ -359,7 +359,7 @@ void RFCOMM_LineStatusReq (tRFC_MCB *p_mcb, UINT8 dlci, UINT8 status)
*******************************************************************************/
void RFCOMM_DlcReleaseReq (tRFC_MCB *p_mcb, UINT8 dlci)
{
rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, 0);
rfc_port_sm_execute(port_find_mcb_dlci_port (p_mcb, dlci), RFC_EVENT_CLOSE, NULL);
}
components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c
+8 -13
View File
@@ -527,16 +527,12 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr)
UINT8 dlci;
BOOLEAN get_dlci = FALSE;
tPORT *p_port;
tPORT_CTRL *p_pars;
tPORT_CTRL pars;
tRFC_MCB *p_mcb;
if ((p_pars = (tPORT_CTRL *)osi_malloc(sizeof(tPORT_CTRL))) == NULL) {
return;
}
p_pars->modem_signal = 0;
p_pars->break_signal = 0;
p_pars->fc = TRUE;
pars.modem_signal = 0;
pars.break_signal = 0;
pars.fc = TRUE;
p_mcb = port_find_mcb (cert_pts_addr);
@@ -549,12 +545,11 @@ void rfc_bqb_send_msc_cmd(BD_ADDR cert_pts_addr)
}
}
if (get_dlci) {
rfc_send_msc(p_mcb, dlci, TRUE, p_pars);
if (get_dlci && p_mcb) {
rfc_send_msc(p_mcb, dlci, TRUE, &pars);
} else {
RFCOMM_TRACE_ERROR ("Get dlci fail");
}
osi_free(p_pars);
}
#endif /* BT_RFCOMM_BQB_INCLUDED */
@@ -794,7 +789,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf)
RFCOMM_TRACE_ERROR("Illegal MX Frame len:%d < 2", length);
osi_free(p_buf);
return;
}
}
p_rx_frame->ea = *p_data & RFCOMM_EA;
p_rx_frame->cr = (*p_data & RFCOMM_CR_MASK) >> RFCOMM_SHIFT_CR;
@@ -991,7 +986,7 @@ void rfc_process_mx_message (tRFC_MCB *p_mcb, BT_HDR *p_buf)
if (!ea || !cr || !p_rx_frame->dlci
|| !RFCOMM_VALID_DLCI (p_rx_frame->dlci)) {
RFCOMM_TRACE_ERROR ("Bad RPN frame");
RFCOMM_TRACE_ERROR ("Bad RLS frame");
break;
}
components/bt/host/bluedroid/stack/rfcomm/rfc_utils.c
+7 -7
View File
@@ -121,6 +121,10 @@ BOOLEAN rfc_check_fcs (UINT16 len, UINT8 *p, UINT8 received_fcs)
return (fcs == 0xCF);
}
void osi_free_fun(void *p)
{
osi_free(p);
}
/*******************************************************************************
**
@@ -168,7 +172,7 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator)
p_mcb = &rfc_cb.port.rfc_mcb[j];
if (rfc_cb.port.rfc_mcb[j].state == RFC_MX_STATE_IDLE) {
/* New multiplexer control block */
fixed_queue_free(p_mcb->cmd_q, NULL);
fixed_queue_free(p_mcb->cmd_q, osi_free_fun);
rfc_timer_free(p_mcb);
memset (p_mcb, 0, sizeof (tRFC_MCB));
memcpy (p_mcb->bd_addr, bd_addr, BD_ADDR_LEN);
@@ -188,15 +192,11 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator)
return (NULL);
}
void osi_free_fun(void *p)
{
osi_free(p);
}
/*******************************************************************************
**
** Function rfc_release_multiplexer_channel
**
** Description This function returns existing or new control block for
** Description This function releases existing control block for
** the BD_ADDR.
**
*******************************************************************************/
@@ -299,7 +299,7 @@ void rfc_port_timer_stop (tPORT *p_port)
*******************************************************************************/
void rfc_port_timer_free (tPORT *p_port)
{
RFCOMM_TRACE_EVENT ("rfc_port_timer_stop");
RFCOMM_TRACE_EVENT ("rfc_port_timer_free");
btu_free_timer (&p_port->rfc.tle);
memset(&p_port->rfc.tle, 0, sizeof(TIMER_LIST_ENT));