Commit Graph
29702 Commits
Author SHA1 Message Date
morris 9727ba62c3 Merge branch 'bugfix/ana_cmpr_macro_v5.3' into 'release/v5.3'
fix(ana_cmpr): Fix swapped POS/NEG cross interrupt masks on ESP32-C5/P4 (v5.3)

See merge request espressif/esp-idf!50802
2026-07-23 14:56:22 +08:00
Island 8f897fb259 Merge branch 'fix/ble_log_compression_safety_v5.3' into 'release/v5.3'
fix(ble_log): fix unaligned access and buffer safety in log compression (5.3)

See merge request espressif/esp-idf!47928
2026-07-23 14:22:57 +08:00
Jin Cheng ed20c79614 change(bt/bluedroid): increased port low watermark of RFCOMM
When PORT_RX_BUF_LOW_WM is too low, RFCOMM replenishes credits only
after receiving a relatively large number of packets, which may cause
the peer to exhaust its credits and enter a stop-and-wait state.
Increase the low watermark to replenish credits more promptly and
reduce the likelihood of the peer stalling while waiting for additional
credits.
2026-07-23 08:11:29 +08:00
Jin Cheng d70a124dec fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:53:22 +08:00
Jack f69b8bde01 fix(phy): removed all librfate logic from cmake 2026-07-22 20:06:39 +08:00
zhuanghang 0476dfa707 feat(phy): update phy lib for esp32s31 & esp32c6 for track 2026-07-22 20:06:24 +08:00
yangfeng ff7ce10233 fix(bt): Fix the high issues related to AVRCP from AI review report
- SDP/registration: handle SDP record creation and discovery failures safely
- AVRC stack: fix packet checks, fragment leaks, response build, and compile guards
- BTC AVRCP: fix return codes, connection state, metadata parsing, and memory leaks
- AVCTP: fix event passing, L2CAP conflicts, TX queue leaks, and disconnect handling
- Example: remove TG RN capability setup before initialization
2026-07-22 17:33:27 +08:00
yangfeng 3138799982 fix(bt): Fix the critical issues related to AVRCP from AI review report
- recalculate len_left per attribute in avrc_bld_app_setting_text_rsp
- abort fragmented message reassembly when reassembly buffer alloc fails
2026-07-22 17:32:28 +08:00
Astha Verma 75fd7a08cc fix(nimble): Handle Read Remote Supported Features failure correctly 2026-07-22 12:21:07 +05:30
Island e171d8c754 Merge branch 'fix/ble-log-store-access-fault_v5.3' into 'release/v5.3'
fix: Ensure BLE Log Global Variables in Internal RAM (5.3)

See merge request espressif/esp-idf!51033
2026-07-22 14:02:54 +08:00
Tiago Medicci e9e6a3dcf0 test(ana_cmpr): Add edge-specific interrupt direction test case
Add a Unity test case that arms only ANA_CMPR_CROSS_POS (resp. only
ANA_CMPR_CROSS_NEG) on a unit and asserts that a real transition of
the matching direction fires the callback exactly once, while a
transition of the opposite (never-armed) direction does not fire at
all.

This closes a gap in the existing test_apps: none of the current
cases isolate cross direction, so a swapped POS/NEG interrupt mask in
the LL layer (fixed in the previous commit) previously went
undetected.

On the scan-based comparator IP (ESP32-H4/S31), a crossing is only
sampled/latched when a scan is explicitly triggered, so the new test
case also triggers a scan after each level change on that IP, plus
one extra priming scan right after enabling the unit so the internal
compare state starts in sync with the already-set initial GPIO level.

Signed-off-by: Tiago Medicci <tiago.medicci@espressif.com>
2026-07-22 12:11:17 +08:00
Tiago Medicci 5cc17ee75a fix(ana_cmpr): Fix swapped POS/NEG cross interrupt masks on ESP32-P4 2026-07-22 12:11:17 +08:00
Mahavir Jain c14fc50a34 Merge branch 'feat/mbedtls_update_3.6.7_v5.3' into 'release/v5.3'
feat(mbedtls): update to version 3.6.7 (v5.3)

See merge request espressif/esp-idf!50659
2026-07-22 09:00:54 +05:30
Zhou Xiao f0be40c78e fix(bt): keep BLE log ISR state in internal RAM
(cherry picked from commit 2fa434eb50)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
2026-07-21 19:44:12 +08:00
Euripedes Rocha 7ec3fe8a2c Merge branch 'fix/sec-1137-br-glue-double-free_v5.3' into 'release/v5.3'
fix(esp_netif): harden br_glue instance-handler cleanup against double-free (SEC-1137) (v5.3)

See merge request espressif/esp-idf!50646
2026-07-21 10:42:25 +02:00
yangfeng dac2ceaaa5 fix(bt): Fix the pointer sbc_start_frame is not initialized
- Closes https://github.com/espressif/esp-idf/issues/18835
2026-07-21 16:10:31 +08:00
Ashish Sharma 25b55da173 feat(mbedtls): add option to choose constant-time prime generation 2026-07-21 16:00:42 +08:00
Ashish Sharma e6fa7d627e feat(mbedtls): update to version 3.6.7 2026-07-21 15:49:22 +08:00
luoxu 97ffb2db24 fix(bt): reorder test imports to satisfy pre-commit 2026-07-21 15:33:27 +08:00
luoxu 55a58720d9 fix(ble_log): use typing.Optional/List for Python 3.9 compatibility 2026-07-21 14:17:49 +08:00
Luo Xu b57260f260 fix(ble_log): fix size_info nibble misalignment for last odd-count arg
(cherry picked from commit f5a927e055)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-21 14:17:49 +08:00
Luo Xu 215e6f5aa0 test(ble): add comprehensive test suite for log compression
(cherry picked from commit 58121d2540)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-21 14:17:49 +08:00
Luo Xu 5be9215c10 fix(ble): replace hardcoded tuple indices with FormatToken NamedTuple
(cherry picked from commit b7760a77e4)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-21 14:17:49 +08:00
Luo Xu 9f0c244082 fix(ble_log): fix unaligned access and buffer safety in log compression
(cherry picked from commit 3f2b6c97f8)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-21 14:17:49 +08:00
Zhang Hai Peng 4128693b65 fix(ble/bluedroid): track ext scan state for rand addr check
Update inq_var.state only after btsnd_hcic_ble_ext_scan_enable succeeds.
Clear BTM_BLE_SCANNING on explicit stop and controller scan timeout.


(cherry picked from commit 23519567e4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-21 10:53:23 +08:00
Zhang Hai Peng fb335e73cc change(ble/bluedroid): disable host trace logs when BLE Log host is off
Default all Bluedroid layer trace levels to NONE when BLE async log
is enabled without BLE_LOG_HOST_LOG.


(cherry picked from commit 1f8f935e3f)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-21 10:44:05 +08:00
Zhang Hai Peng ac93fe0396 fix(esp_hid/bluedroid): remove app-layer CCC gating in HID device
Do not check CCCD before sending notify in battery_set,
input_set and feature_set.


(cherry picked from commit 81bbcaca4e)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-21 10:43:51 +08:00
Island 9f583bc39b Merge branch 'feat/ble_log_compression_module_cfg_update_v5.3' into 'release/v5.3'
Feat/ble log compression module cfg update (5.3)

See merge request espressif/esp-idf!49872
2026-07-20 21:40:58 +08:00
Kapil Gupta 2aee0a3ace fix(roaming): prevent timeout payload double-free on deinit
Track timeout user_data before registration, untrack on register failure
2026-07-20 14:30:18 +05:30
Kapil Gupta c695e7dd32 fix(esp_wifi): Fixed some issues in roaming app found using static analysis 2026-07-20 14:30:18 +05:30
Jin Cheng 08881943c9 fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act
Closes SEC-786
2026-07-20 16:40:24 +08:00
Jiang Jiang Jian 7e30e80444 Merge branch 'fix/blacklist_flag_correction_v5.3' into 'release/v5.3'
fix(wifi): Correct blacklist flag(v5.3)

See merge request espressif/esp-idf!50923
2026-07-20 14:59:33 +08:00
morris 172c013f6a Merge branch 'fix/fix_image_header_check_v5.3' into 'release/v5.3'
image header: fixed image header segment count check (v5.3)

See merge request espressif/esp-idf!50938
2026-07-20 14:22:14 +08:00
Jiang Jiang Jian ba78a3b88d Merge branch 'fix/allow_task_and_coredump_mem_in_spm_v5.3' into 'release/v5.3'
fix(esp_hw_support): update memory pointer checks for SPM support (v5.3)

See merge request espressif/esp-idf!50632
2026-07-20 11:34:23 +08:00
Jiang Jiang Jian d82a409a9d Merge branch 'bugfix/supplicant_crypto_code_correction_v5.3' into 'release/v5.3'
fix(wpa_supplicant): Correct some functions in crypto porting layer (v5.3)

See merge request espressif/esp-idf!50881
2026-07-20 11:34:03 +08:00
Island fa6f2b6133 Merge branch 'bugfix/fix_bluedroid_read_multi_v5.3' into 'release/v5.3'
fix(ble/bluedroid): fix GATT Read Multiple response handling (5.3)

See merge request espressif/esp-idf!50706
2026-07-20 10:37:20 +08:00
Armando (Dou Yiwen) a461861678 fix: fixed image header segment count check
Signed-off-by: Armando (Dou Yiwen) <douyiwen@espressif.com>
2026-07-20 10:25:46 +08:00
yangfeng 26071a5a71 fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC
Closes SEC-1186
2026-07-19 10:25:26 +08:00
yangfeng 46d6b17f62 fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq
Closes SEC-1187
2026-07-19 10:25:26 +08:00
Wang Meng Yang 4d956042dd Merge branch 'bugfix/fix_bredr_inq_crash_v5.3' into 'release/v5.3'
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v5.3)

See merge request espressif/esp-idf!50857
2026-07-19 10:22:17 +08:00
Rahul Tank e69b7f37ff Merge branch 'bugfix/add_dis_ieee_udi_to_config_v5.3' into 'release/v5.3'
fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v5.3)

See merge request espressif/esp-idf!50763
2026-07-18 09:31:51 +05:30
tarun.kumar 3cea633600 fix(wifi): Correct blacklist flag 2026-07-17 18:03:07 +05:30
Wang Meng Yang 8e905e0a52 Merge branch 'bugfix/smp_sec_flags_v5.3' into 'release/v5.3'
fix(bt/bluedroid): fixed several security issues from NVIDIA (v5.3)

See merge request espressif/esp-idf!50569
2026-07-17 20:01:24 +08:00
sonika.rathi fe8249a9a7 fix(spiffs): shorten obj_name_len guard comment 2026-07-17 13:04:12 +02:00
yi chen ed9f3d7950 fix(spiffs): fix off-by-one in spiffsgen.py obj name length check
SpiffsFS.create_file() rejected names only when strictly longer than
obj_name_len, but CONFIG_SPIFFS_OBJ_NAME_LEN's documented semantics
(see components/spiffs/Kconfig) are that the length includes the
zero-termination character, so the maximum number of actual name
characters is obj_name_len - 1.

With the old check, a name exactly obj_name_len characters long was
accepted. SpiffsObjIndexPage.to_binary() then computes the NUL padding
after the name as (obj_name_len - len(name)), which is 0 in that case,
so the generated image's fixed-size name field ends up with no NUL
terminator anywhere in its reserved region.

Fix the boundary so the generator enforces the same maximum length
that the Kconfig help text documents.
2026-07-17 13:04:12 +02:00
yi chen 7fd4573266 fix(esp_partition): prevent size_t overflow bypassing bounds checks on linux target
esp_partition_write/read/erase_range/mmap in partition_linux.c (the
`linux` target backend used by --preview set-target linux / host_test)
validated the requested range with `offset + size > partition->size`.
When `size` is close to SIZE_MAX, this addition wraps around size_t and
can evaluate to a small value, so the check passes even though the
request is far out of bounds. A caller passing e.g.
esp_partition_write(partition, 1, src, SIZE_MAX) sails through both
bounds checks and reaches the byte-copy loop with new_size == SIZE_MAX,
causing out-of-bounds reads/writes far past both the caller's buffer
and the mmap'd emulated-flash file.

Replace all four instances with the overflow-safe form already used by
the other esp_partition backends (partition_target.c,
partition_bootloader.c, partition_tee.c):
`size > partition->size - offset`, which is safe because the preceding
check already guarantees offset <= partition->size.

Signed-off-by: yi chen <94xhn1@gmail.com>
2026-07-17 12:49:31 +02:00
Sumeet Singh 67b458a3ab fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v5.3) 2026-07-17 14:59:47 +05:30
Kapil Gupta 84e46ae39b fix(wpa_supplicant): Correct some functions in crypto porting layer 2026-07-17 14:02:45 +05:30
Rahul Tank 933f1f8b19 fix(nimble): Fix ECC HW byte-order and dropped SOC_ESP_NIMBLE_CONTROLLER 2026-07-17 10:50:06 +05:30
morris acdae8ad4e Merge branch 'fix/uart_is_enable_check_error_on_s3_v5.3' into 'release/v5.3'
Fix ESP32-S3 uart2 is_enabled check error (v5.3)

See merge request espressif/esp-idf!49351
2026-07-17 12:16:26 +08:00