Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected

Browse Source
This commit is contained in:
Jin Cheng
2025-12-19 11:19:23 +08:00
parent 0028cb326a
commit f7058fa32e
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_sec.c
+4 -2
View File
@@ -4278,7 +4278,6 @@ static void btm_sec_connect_after_reject_timeout (TIMER_LIST_ENT *p_tle)
#if (SMP_INCLUDED == TRUE)
void btm_sec_connected (UINT8 *bda, UINT16 handle, UINT8 status, UINT8 enc_mode)
{
tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
UINT8 res;
UINT8 sec_dev_rec_status;
BOOLEAN is_pairing_device = FALSE;
@@ -4287,6 +4286,8 @@ void btm_sec_connected (UINT8 *bda, UINT16 handle, UINT8 status, UINT8 enc_mode)
btm_acl_resubmit_page();
tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
/* Commenting out trace due to obf/compilation problems.
*/
#if (BT_USE_TRACES == TRUE && SMP_INCLUDED == TRUE)
@@ -4609,7 +4610,6 @@ tBTM_STATUS btm_sec_disconnect (UINT16 handle, UINT8 reason)
*******************************************************************************/
BOOLEAN btm_sec_disconnected (UINT16 handle, UINT8 reason)
{
tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev_by_handle (handle);
UINT8 old_pairing_flags = btm_cb.pairing_flags;
int result = HCI_ERR_AUTH_FAILURE;
tBTM_SEC_CALLBACK *p_callback = NULL;
@@ -4622,6 +4622,8 @@ BOOLEAN btm_sec_disconnected (UINT16 handle, UINT8 reason)
btm_acl_resubmit_page();
#endif
tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev_by_handle (handle);
if (!p_dev_rec) {
return FALSE;
}