Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed the vulerabilities from AI code review in HID

Browse Source
This commit is contained in:
Jin Cheng
2026-05-09 11:04:35 +08:00
committed by Jin Cheng
parent c504a04a93
commit f45c7f0aaa
15 changed files with 387 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/api/esp_hidd_api.c
+27 -3
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*
@@ -20,7 +20,7 @@ esp_err_t esp_bt_hid_device_register_callback(esp_hd_cb_t callback)
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (callback == NULL) {
return ESP_FAIL;
return ESP_ERR_INVALID_ARG;
}
btc_profile_cb_set(BTC_PID_HD, callback);
@@ -58,6 +58,16 @@ esp_err_t esp_bt_hid_device_register_app(esp_hidd_app_param_t* app_param, esp_hi
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((app_param == NULL) || (in_qos == NULL) || (out_qos == NULL)) {
return ESP_ERR_INVALID_ARG;
}
if ((app_param->desc_list_len <= 0) || (app_param->desc_list_len > ESP_HIDD_APP_DESC_LIST_LEN_MAX) || (app_param->desc_list == NULL)) {
return ESP_ERR_INVALID_ARG;
}
if ((app_param->name == NULL) || (app_param->description == NULL) || (app_param->provider == NULL)) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
btc_hidd_args_t args;
memset(&args, 0, sizeof(btc_hidd_args_t));
@@ -69,7 +79,8 @@ esp_err_t esp_bt_hid_device_register_app(esp_hidd_app_param_t* app_param, esp_hi
msg.pid = BTC_PID_HD;
msg.act = BTC_HD_REGISTER_APP_EVT;
bt_status_t stat = btc_transfer_context(&msg, &args, sizeof(btc_hidd_args_t), NULL, NULL);
bt_status_t stat = btc_transfer_context(&msg, &args, sizeof(btc_hidd_args_t),
btc_hd_arg_deep_copy, btc_hd_call_arg_deep_free);
return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
}
@@ -90,6 +101,10 @@ esp_err_t esp_bt_hid_device_connect(esp_bd_addr_t bd_addr)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
btc_hidd_args_t args;
memset(&args, 0, sizeof(btc_hidd_args_t));
@@ -120,6 +135,10 @@ esp_err_t esp_bt_hid_device_send_report(esp_hidd_report_type_t type, uint8_t id,
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((type < ESP_HIDD_REPORT_TYPE_OTHER) || (type > ESP_HIDD_REPORT_TYPE_INTRDATA) || (data == NULL) || (len == 0)) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HD;
@@ -141,6 +160,11 @@ esp_err_t esp_bt_hid_device_report_error(esp_hidd_handshake_error_t error)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((error < ESP_HID_PAR_HANDSHAKE_RSP_SUCCESS) || (error > ESP_HID_PAR_HANDSHAKE_RSP_ERR_FATAL) ||
((error > ESP_HID_PAR_HANDSHAKE_RSP_ERR_INVALID_PARAM) && (error < ESP_HID_PAR_HANDSHAKE_RSP_ERR_UNKNOWN))) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HD;
components/bt/host/bluedroid/api/esp_hidh_api.c
+46 -5
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*
@@ -18,9 +18,8 @@
esp_err_t esp_bt_hid_host_register_callback(esp_hh_cb_t callback)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if (callback == NULL) {
return ESP_FAIL;
return ESP_ERR_INVALID_ARG;
}
btc_profile_cb_set(BTC_PID_HH, callback);
@@ -30,7 +29,6 @@ esp_err_t esp_bt_hid_host_register_callback(esp_hh_cb_t callback)
esp_err_t esp_bt_hid_host_init(void)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
btc_msg_t msg;
msg.sig = BTC_SIG_API_CALL;
@@ -44,7 +42,6 @@ esp_err_t esp_bt_hid_host_init(void)
esp_err_t esp_bt_hid_host_deinit(void)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
btc_msg_t msg;
msg.sig = BTC_SIG_API_CALL;
@@ -61,6 +58,10 @@ esp_err_t esp_bt_hid_host_connect(esp_bd_addr_t bd_addr)
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_CONNECT_EVT;
@@ -77,6 +78,10 @@ esp_err_t esp_bt_hid_host_disconnect(esp_bd_addr_t bd_addr)
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_DISCONNECT_EVT;
@@ -93,6 +98,10 @@ esp_err_t esp_bt_hid_host_virtual_cable_unplug(esp_bd_addr_t bd_addr)
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_UNPLUG_EVT;
@@ -106,6 +115,10 @@ esp_err_t esp_bt_hid_host_virtual_cable_unplug(esp_bd_addr_t bd_addr)
esp_err_t esp_bt_hid_host_set_info(esp_bd_addr_t bd_addr, esp_hidh_hid_info_t *hid_info)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((bd_addr == NULL) || (hid_info == NULL) || (hid_info->dl_len < 0) || (hid_info->dl_len > BTHH_MAX_DSC_LEN)) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
btc_hidh_args_t arg;
@@ -127,6 +140,10 @@ esp_err_t esp_bt_hid_host_get_protocol(esp_bd_addr_t bd_addr)
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_GET_PROTO_EVT;
@@ -143,6 +160,10 @@ esp_err_t esp_bt_hid_host_set_protocol(esp_bd_addr_t bd_addr, esp_hidh_protocol_
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_SET_PROTO_EVT;
@@ -160,6 +181,10 @@ esp_err_t esp_bt_hid_host_get_idle(esp_bd_addr_t bd_addr)
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_GET_IDLE_EVT;
@@ -176,6 +201,10 @@ esp_err_t esp_bt_hid_host_set_idle(esp_bd_addr_t bd_addr, uint16_t idle_time)
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_SET_IDLE_EVT;
@@ -194,6 +223,10 @@ esp_err_t esp_bt_hid_host_get_report(esp_bd_addr_t bd_addr, esp_hidh_report_type
btc_msg_t msg;
btc_hidh_args_t arg;
if (bd_addr == NULL) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_HH;
msg.act = BTC_HH_GET_REPORT_EVT;
@@ -211,6 +244,10 @@ esp_err_t esp_bt_hid_host_set_report(esp_bd_addr_t bd_addr, esp_hidh_report_type
size_t len)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((bd_addr == NULL) || (report == NULL) || (len == 0)) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
btc_hidh_args_t arg;
@@ -231,6 +268,10 @@ esp_err_t esp_bt_hid_host_set_report(esp_bd_addr_t bd_addr, esp_hidh_report_type
esp_err_t esp_bt_hid_host_send_data(esp_bd_addr_t bd_addr, uint8_t *data, size_t len)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
if ((bd_addr == NULL) || (data == NULL) || (len == 0)) {
return ESP_ERR_INVALID_ARG;
}
btc_msg_t msg;
btc_hidh_args_t arg;
components/bt/host/bluedroid/api/include/api/esp_hidd_api.h
+3
View File
@@ -28,6 +28,9 @@ extern "C" {
#define ESP_HID_CLASS_MIC (0x20<<2) /*!< pointing device */
#define ESP_HID_CLASS_COM (0x30<<2) /*!< combo keyboard/pointing */
/** Maximum length of HID Device descriptor list */
#define ESP_HIDD_APP_DESC_LIST_LEN_MAX 2048
/**
* @brief HIDD handshake result code
*/