From fab68dc82ffa42eabdce1ec97f279a36e1fa745b Mon Sep 17 00:00:00 2001
From: Zhi Wei Jian <zhiweijian@espressif.com>
Date: Tue, 14 Jul 2026 12:04:07 +0800
Subject: [PATCH] fix(ble/bluedroid): validate SMP pair-fail reason and OOB
 device

(cherry picked from commit 98efe023859b7618bd27e95f799ca050e8d77da9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
---
 components/bt/host/bluedroid/stack/smp/smp_act.c | 13 +++++++++++--
 components/bt/host/bluedroid/stack/smp/smp_api.c | 11 +++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/components/bt/host/bluedroid/stack/smp/smp_act.c b/components/bt/host/bluedroid/stack/smp/smp_act.c
index ba20aaeda30..42d7078a3b2 100644
--- a/components/bt/host/bluedroid/stack/smp/smp_act.c
+++ b/components/bt/host/bluedroid/stack/smp/smp_act.c
@@ -522,8 +522,17 @@ void smp_proc_sec_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 *******************************************************************************/
 void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 {
-    SMP_TRACE_DEBUG("%s", __func__);
-    p_cb->status = *(UINT8 *)p_data;
+    UINT8 reason = *(UINT8 *)p_data;
+
+    SMP_TRACE_DEBUG("%s reason=0x%02x", __func__, reason);
+    /* A peer may send a reserved or out-of-range reason code; normalize it so
+     * upper layers always receive a defined pairing failure status. */
+    if (reason == SMP_SUCCESS || reason > SMP_MAX_FAIL_RSN_PER_SPEC) {
+        SMP_TRACE_WARNING("%s invalid pairing fail reason 0x%02x", __func__, reason);
+        reason = SMP_PAIR_FAIL_UNKNOWN;
+    }
+    p_cb->status = reason;
+    p_cb->failure = reason;
 }
 
 /*******************************************************************************
diff --git a/components/bt/host/bluedroid/stack/smp/smp_api.c b/components/bt/host/bluedroid/stack/smp/smp_api.c
index 7a592b775d6..e91f4fe619b 100644
--- a/components/bt/host/bluedroid/stack/smp/smp_api.c
+++ b/components/bt/host/bluedroid/stack/smp/smp_api.c
@@ -443,6 +443,17 @@ void SMP_OobDataReply(BD_ADDR bd_addr, tSMP_STATUS res, UINT8 len, UINT8 *p_data
         return;
     }
 
+    /* Reject an OOB reply that does not match the device currently pairing. */
+    if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
+        SMP_TRACE_ERROR("%s() - Wrong BD Addr", __func__);
+        return;
+    }
+
+    if (btm_find_dev(bd_addr) == NULL) {
+        SMP_TRACE_ERROR("%s() - no dev CB", __func__);
+        return;
+    }
+
     if (res != SMP_SUCCESS || len == 0 || !p_data) {
         SMP_TRACE_ERROR("%s pairing failed, res=0x%x len=%u p_data=%p",
             __func__, res, len, p_data);