Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity
44,132 Commits 25 Branches 192 Tags
02df985a3610355caf94de3ae28bb67616f1bb03
Commit Graph

500 Commits

Author SHA1 Message Date
zhiweijian
3faa799eef fix(ble/bluedroid): Fixed CTE IQ sample data copy error 2025-12-30 11:29:22 +08:00
zhiweijian
9bf0a8984f fix(ble/bluedroid): Optimize some bluedroid code 2025-12-30 11:29:12 +08:00
zhiweijian
5dbfb083fc fix(ble/bluedroid): Fixed big event status error 2025-12-30 11:29:01 +08:00
zhiweijian
ba96bb2c1d feat(ble/bluedroid): support bluedroid host channel sounding feature 2025-12-30 11:28:50 +08:00
zhiweijian
37c75157dc feat(ble/bluedroid): Supported BLE bluedroid host pawr connection 2025-12-30 11:28:15 +08:00
zhiweijian
fff1b9cf31 feat(ble/bluedroid): Support LE Security Levels Characteristic 2025-12-30 10:23:58 +08:00
zhiweijian
570e8c2731 feat(ble/bluedroid): Add bluedroid host Advertising Coding Selection feature 2025-12-30 10:23:48 +08:00
zhiweijian
a52993a7eb feat(ble/bluedroid): Add bluedroid host PAwR feature 2025-12-30 10:23:37 +08:00
Wang Meng Yang
2f648afdde Merge branch 'change/bt_bluedroid_avrcp_version_v5.4' into 'release/v5.4' 
change(bt/bluedroid): Change AVRCP version according to feature enabled (v5.4)

See merge request espressif/esp-idf!44201
 2025-12-24 14:12:15 +08:00
Jin Cheng
0fb6be8d87 fix(bt/bluedroid): cleaned the code according to the tool cppcheck 2025-12-19 17:02:01 +08:00
Jin Cheng
caf1c72daf fix(bt/bluedroid): fixed possible OOB read in smp_br_data_received 2025-12-19 17:01:59 +08:00
Jin Cheng
4e708d2ef2 fix(bt/bluedroid): drop connection when atttempting to disable encryption 2025-12-19 17:01:56 +08:00
Jin Cheng
8f6e0b5a37 fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd 2025-12-19 17:01:54 +08:00
Jin Cheng
fe6cf47013 fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl 2025-12-19 17:01:52 +08:00
Jin Cheng
cec99a9f9a fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete 2025-12-19 11:20:20 +08:00
Jin Cheng
97e382b1b0 fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete 2025-12-19 11:20:20 +08:00
Jin Cheng
558e02999b fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete 2025-12-19 11:20:20 +08:00
Jin Cheng
4a5656b964 fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete 2025-12-19 11:20:20 +08:00
Jin Cheng
89dbbc6f37 fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete 2025-12-19 11:20:20 +08:00
Jin Cheng
6d393a43ba fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute 2025-12-19 11:20:20 +08:00
Jin Cheng
83a2690415 fix(bt/bluedroid): added negative length check in process_service_search_rsp 2025-12-19 11:20:20 +08:00
Jin Cheng
611d1236af fix(bt/bluedroid): fixed OOB read in SDP server continuation length 2025-12-19 11:20:20 +08:00
Jin Cheng
4d3b4c1d35 fix(bt/bluedroid): added length check when copy AVDTP packet 2025-12-19 11:20:20 +08:00
Jin Cheng
b59d0541a9 fix(bt/bluedroid): added boundary check when reading SDP attribute response packet 2025-12-19 11:20:20 +08:00
Jin Cheng
866130578f fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp 2025-12-19 11:20:15 +08:00
Jin Cheng
d6e6b14236 fix(bt/bluedroid): fixed potential OOB read in the reporting handler 
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
 2025-12-19 11:19:23 +08:00
Jin Cheng
5bc344f900 fix(bt/bluedroid): fixed a potential overflow about the media payload offset 
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
 2025-12-19 11:19:23 +08:00
Jin Cheng
3619e43002 fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2025-12-19 11:19:23 +08:00
Jin Cheng
f7058fa32e fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2025-12-19 11:19:23 +08:00
Jin Cheng
0028cb326a fix(bt/bluedroid): reject device with same address in legacy paring 2025-12-19 11:19:23 +08:00
Jin Cheng
073965fd31 fix(bt/bluedroid): ignore AVCT commands that are too long 2025-12-19 11:19:23 +08:00
Jin Cheng
648f0396b8 fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2025-12-19 11:19:23 +08:00
Jin Cheng
44b566ab5e fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2025-12-19 11:19:23 +08:00
Jin Cheng
bcdca970d4 fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-19 11:19:23 +08:00
Island
c678100216 Merge branch 'bugfix/fix_ble_security_issue_2025_v5.4' into 'release/v5.4' 
Fix potential CVE-2024-0039 out-of-bounds write in attp_build_value_cmd (v5.4)

See merge request espressif/esp-idf!43806
 2025-12-18 10:55:49 +08:00
Island
fafa8211cc Merge branch 'bugfix/fix_reconnect_failed_with_extend_adv_v5.4' into 'release/v5.4' 
fix(ble/bluedroid): Fixed the issue that extend advertising might not restart if the connection fails (v5.4)

See merge request espressif/esp-idf!44250
 2025-12-18 10:51:23 +08:00
Jin Cheng
57a0937abd fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf 2025-12-16 11:39:21 +08:00
Zhi Wei Jian
23caa76a40 fix(ble/bluedroid): Fixed reconnection failed with extend adv 
(cherry picked from commit ec4052c1c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2025-12-15 21:23:24 +08:00
linruihao
dad305090f change(bt/bluedroid): Change AVRCP version according to feature enabled 
- Version will be set to 1.6 if Cover Art feature enabled
- Otherwise, version will be set to 1.5
 2025-12-12 20:11:21 +08:00
Zhang Hai Peng
ee328c7c34 fix(ble/bluedroid): Fix security issues in GATT module 
(cherry picked from commit f502b2aab1)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-12-03 11:54:13 +08:00
Zhang Hai Peng
7a367e55c5 fix(ble/bluedroid): Fix security issues in GAP module 
(cherry picked from commit 1ed5a4465d)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-12-03 11:54:13 +08:00
Zhang Hai Peng
36ad31952c fix(ble/bluedroid): Add length check in prepare write response 
(cherry picked from commit b03ff3cf21)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-12-03 11:54:12 +08:00
Zhang Hai Peng
cfae16dc28 fix(ble/bluedroid): Add boundary check for adv_handle in btm_ble_adv_set_terminated_evt 
(cherry picked from commit d2baf3b0d4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-12-03 11:54:12 +08:00
Zhang Hai Peng
75071beea4 fix(ble/bluedroid): Fix potential out-of-bounds issue 
- add length check in hci_hal_h4_hdl_rx_packet to prevent OOB
- add adv data length check in btm_ble_cache_adv_data
- add indicate data length check in BTA_GATTS_HandleValueIndication
- add report length check in bta_hh_parse_keybd_rpt
- add report length check in BTA_HdSendReport
- add descriptor length check in BTA_HdRegisterApp
- prevent buffer overflow in attribute processing


(cherry picked from commit 71efec78c5)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-11-27 20:10:17 +08:00
Zhang Hai Peng
62b2bc72a5 fix(ble/bluedroid): Fix potential CVE-2024-0039 out-of-bounds write in attp_build_value_cmd 
- Reference: https://source.android.com/docs/security/bulletin/2024-03-01?hl=zh-cn


(cherry picked from commit e1d39f630f)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-11-27 20:10:17 +08:00
Island
2798c89d3a Merge branch 'bugfix/bug_ble_max_device_record_v5.4' into 'release/v5.4' 
fix(ble/bluedroid): Fixed BLE incorrect device record count issue (v5.4)

See merge request espressif/esp-idf!43596
 2025-11-27 18:25:48 +08:00
Zhang Hai Peng
354e6c18dc fix(ble/bluedroid): Fixed missing BLE connect and disconnect events 
(cherry picked from commit 2dcbd64616)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-11-21 21:53:22 +08:00
chenjianhua
adb4cab44a feat(ble/bluedroid): Add more debug log for bluedroid 2025-11-21 13:29:44 +08:00
chenjianhua
b50852df25 fix(ble/bluedroid): Fixed GATT response timeout setting 2025-11-21 13:28:58 +08:00
Island
bd11845900 Merge branch 'opt/opt_ble_log_v5.4' into 'release/v5.4' 
feat(ble/bluedroid): Added BLE debug LOG for bluedroid (v5.4)

See merge request espressif/esp-idf!42269
 2025-11-18 13:52:00 +08:00