From 31d51adf4fb7156ac3612477dcd9aa7054d86960 Mon Sep 17 00:00:00 2001 From: yangfeng Date: Fri, 3 Jul 2026 11:15:48 +0800 Subject: [PATCH 1/2] fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq Closes SEC-1187 --- components/bt/host/bluedroid/stack/avdt/avdt_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/bt/host/bluedroid/stack/avdt/avdt_api.c b/components/bt/host/bluedroid/stack/avdt/avdt_api.c index 81c0fa2e8b9..50de972186a 100644 --- a/components/bt/host/bluedroid/stack/avdt/avdt_api.c +++ b/components/bt/host/bluedroid/stack/avdt/avdt_api.c @@ -776,6 +776,10 @@ UINT16 AVDT_ReconfigReq(UINT8 handle, tAVDT_CFG *p_cfg) UINT16 result = AVDT_SUCCESS; tAVDT_SCB_EVT evt; + if (p_cfg == NULL) { + return AVDT_BAD_PARAMS; + } + /* map handle to scb */ if ((p_scb = avdt_scb_by_hdl(handle)) == NULL) { result = AVDT_BAD_HANDLE; From b7d0ef96a7c8731d4882de5a9506e2286ad1c405 Mon Sep 17 00:00:00 2001 From: yangfeng Date: Fri, 3 Jul 2026 11:21:09 +0800 Subject: [PATCH 2/2] fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC Closes SEC-1186 --- .../bt/host/bluedroid/stack/avct/avct_ccb.c | 4 +- .../host/bluedroid/stack/avct/avct_lcb_act.c | 41 +++++++++++++------ 2 files changed, 32 insertions(+), 13 deletions(-) diff --git a/components/bt/host/bluedroid/stack/avct/avct_ccb.c b/components/bt/host/bluedroid/stack/avct/avct_ccb.c index 01f0d56f076..70063cf2f06 100644 --- a/components/bt/host/bluedroid/stack/avct/avct_ccb.c +++ b/components/bt/host/bluedroid/stack/avct/avct_ccb.c @@ -92,7 +92,9 @@ void avct_ccb_dealloc(tAVCT_CCB *p_ccb, UINT8 event, UINT16 result, BD_ADDR bd_a #endif if (event != AVCT_NO_EVT) { - (*p_cback)(avct_ccb_to_idx(p_ccb), event, result, bd_addr); + if (p_cback) { + (*p_cback)(avct_ccb_to_idx(p_ccb), event, result, bd_addr); + } } } diff --git a/components/bt/host/bluedroid/stack/avct/avct_lcb_act.c b/components/bt/host/bluedroid/stack/avct/avct_lcb_act.c index 97d81b497ee..f2edec6b165 100644 --- a/components/bt/host/bluedroid/stack/avct/avct_lcb_act.c +++ b/components/bt/host/bluedroid/stack/avct/avct_lcb_act.c @@ -251,8 +251,10 @@ void avct_lcb_open_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) if (p_ccb->p_lcb == p_lcb) { bind = TRUE; L2CA_SetTxPriority(p_lcb->ch_lcid, L2CAP_CHNL_PRIORITY_HIGH); - p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_CFM_EVT, - 0, p_lcb->peer_addr); + if (p_ccb->cc.p_ctrl_cback) { + p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_CFM_EVT, + 0, p_lcb->peer_addr); + } } /* if unbound acceptor and lcb doesn't already have a ccb for this PID */ else if ((p_ccb->p_lcb == NULL) && (p_ccb->cc.role == AVCT_ACP) && @@ -261,8 +263,10 @@ void avct_lcb_open_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) bind = TRUE; p_ccb->p_lcb = p_lcb; L2CA_SetTxPriority(p_lcb->ch_lcid, L2CAP_CHNL_PRIORITY_HIGH); - p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_IND_EVT, - 0, p_lcb->peer_addr); + if (p_ccb->cc.p_ctrl_cback) { + p_ccb->cc.p_ctrl_cback(avct_ccb_to_idx(p_ccb), AVCT_CONNECT_IND_EVT, + 0, p_lcb->peer_addr); + } } } } @@ -321,8 +325,10 @@ void avct_lcb_close_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) 0, p_lcb->peer_addr); } else { p_ccb->p_lcb = NULL; - (*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), AVCT_DISCONNECT_IND_EVT, - 0, p_lcb->peer_addr); + if (p_ccb->cc.p_ctrl_cback) { + (*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), AVCT_DISCONNECT_IND_EVT, + 0, p_lcb->peer_addr); + } } } } @@ -359,8 +365,10 @@ void avct_lcb_close_cfm(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) avct_ccb_dealloc(p_ccb, event, p_data->result, p_lcb->peer_addr); } else { p_ccb->p_lcb = NULL; - (*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event, - p_data->result, p_lcb->peer_addr); + if (p_ccb->cc.p_ctrl_cback) { + (*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event, + p_data->result, p_lcb->peer_addr); + } } } } @@ -379,8 +387,10 @@ void avct_lcb_close_cfm(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) void avct_lcb_bind_conn(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) { p_data->p_ccb->p_lcb = p_lcb; - (*p_data->p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_data->p_ccb), - AVCT_CONNECT_CFM_EVT, 0, p_lcb->peer_addr); + if (p_data->p_ccb->cc.p_ctrl_cback) { + (*p_data->p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_data->p_ccb), + AVCT_CONNECT_CFM_EVT, 0, p_lcb->peer_addr); + } } /******************************************************************************* @@ -481,7 +491,9 @@ void avct_lcb_cong_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) /* send event to all ccbs on this lcb */ for (i = 0; i < AVCT_NUM_CONN; i++, p_ccb++) { if (p_ccb->allocated && (p_ccb->p_lcb == p_lcb)) { - (*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event, 0, p_lcb->peer_addr); + if (p_ccb->cc.p_ctrl_cback) { + (*p_ccb->cc.p_ctrl_cback)(avct_ccb_to_idx(p_ccb), event, 0, p_lcb->peer_addr); + } } } } @@ -683,7 +695,12 @@ void avct_lcb_msg_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data) /* PID found; send msg up, adjust bt hdr and call msg callback */ p_data->p_buf->offset += AVCT_HDR_LEN_SINGLE; p_data->p_buf->len -= AVCT_HDR_LEN_SINGLE; - (*p_ccb->cc.p_msg_cback)(avct_ccb_to_idx(p_ccb), label, cr_ipid, p_data->p_buf); + if (p_ccb->cc.p_msg_cback) { + (*p_ccb->cc.p_msg_cback)(avct_ccb_to_idx(p_ccb), label, cr_ipid, p_data->p_buf); + } else { + osi_free(p_data->p_buf); + p_data->p_buf = NULL; + } } else { /* PID not found; drop message */ AVCT_TRACE_WARNING("No ccb for PID=%x", pid);