Commit Graph
4976 Commits
Author SHA1 Message Date
Jin Cheng d6e6b14236 fix(bt/bluedroid): fixed potential OOB read in the reporting handler
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-19 11:19:23 +08:00
Jin Cheng 5bc344f900 fix(bt/bluedroid): fixed a potential overflow about the media payload offset
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-19 11:19:23 +08:00
Jin Cheng 3619e43002 fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2025-12-19 11:19:23 +08:00
Jin Cheng f7058fa32e fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2025-12-19 11:19:23 +08:00
Jin Cheng 0028cb326a fix(bt/bluedroid): reject device with same address in legacy paring 2025-12-19 11:19:23 +08:00
Jin Cheng 073965fd31 fix(bt/bluedroid): ignore AVCT commands that are too long 2025-12-19 11:19:23 +08:00
Jin Cheng 648f0396b8 fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2025-12-19 11:19:23 +08:00
Jin Cheng 0b8f1f0b0c fix(bt/bluedroid): make sure SDP only start discovery once 2025-12-19 11:19:23 +08:00
Jin Cheng 44b566ab5e fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2025-12-19 11:19:23 +08:00
Jin Cheng bcdca970d4 fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-19 11:19:23 +08:00
Jin Cheng 8e354a7541 fix(bt/blurdoird): enable bitpool snity checks 2025-12-19 11:19:23 +08:00
Luo Xu 9592fcf3e2 fix(ble_mesh): fixed incorrect rpl behavior in transport enh
(cherry picked from commit 29a722296f)

Co-authored-by: luoxu <luoxu@espressif.com>
2025-12-18 17:43:14 +08:00
Zhou Xiao 7ea4ce9e00 fix(ble): added missed spin lock initialization
(cherry picked from commit 069262e513)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
2025-12-18 17:13:37 +08:00
luoxu 84d7f85fdd feat(ble_mesh): dfd client/server supported 2025-12-18 16:28:29 +08:00
luoxu eebead3c3f fix(bt): Fixed the issue of duplicate MAX macro definitions 2025-12-18 16:15:44 +08:00
luoxu 01e214c0a5 feat(ble_mesh): Adapt DFU/MBT to esp-idf 2025-12-18 16:15:44 +08:00
luoxu 85f2e2b89d feat(ble_mesh): Device Firmware Update (Zephyr v4.0.0) 2025-12-18 16:15:44 +08:00
Island fb68633d78 Merge branch 'bugfix/fix_bt_4205_v5.4' into 'release/v5.4'
Fixed BLE assert lld_con.c 1479 on ESP32-C3 and ESP32-S3(5106725) (v5.4)

See merge request espressif/esp-idf!44327
2025-12-18 11:30:55 +08:00
Island c678100216 Merge branch 'bugfix/fix_ble_security_issue_2025_v5.4' into 'release/v5.4'
Fix potential CVE-2024-0039 out-of-bounds write in attp_build_value_cmd (v5.4)

See merge request espressif/esp-idf!43806
2025-12-18 10:55:49 +08:00
Island fafa8211cc Merge branch 'bugfix/fix_reconnect_failed_with_extend_adv_v5.4' into 'release/v5.4'
fix(ble/bluedroid): Fixed the issue that extend advertising might not restart if the connection fails (v5.4)

See merge request espressif/esp-idf!44250
2025-12-18 10:51:23 +08:00
Rahul Tank 86c8597589 Merge branch 'bugfix/fix_compile_tinycrypt_v5.4' into 'release/v5.4'
fix(nimble): Add missing header file to fix compilation issue (v5.4)

See merge request espressif/esp-idf!43886
2025-12-17 12:33:18 +05:30
Chen Jian Hua 617f91cc0b fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(5106725)
- Fixed BLE assert lld_con.c 1479


(cherry picked from commit 22641241fa)

Co-authored-by: chenjianhua <chenjianhua@espressif.com>
2025-12-17 12:53:54 +08:00
Rahul Tank 951a19762b fix(nimble): Add missing header file to fix compilation issue 2025-12-16 12:17:19 +05:30
Jin Cheng 57a0937abd fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf 2025-12-16 11:39:21 +08:00
Zhi Wei Jian 23caa76a40 fix(ble/bluedroid): Fixed reconnection failed with extend adv
(cherry picked from commit ec4052c1c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2025-12-15 21:23:24 +08:00
Island 16653c2499 Merge branch 'fix/fix_pawr_crash_errors_v5.4' into 'release/v5.4'
Fix/fix pawr crash errors (v5.4)

See merge request espressif/esp-idf!43943
2025-12-15 14:21:43 +08:00
Island e7820291d4 Merge branch 'fix/add_soc_caps_for_pawr_feat_v5.4' into 'release/v5.4'
fix(ble): add soc caps feat for PAwR (v5.4)

See merge request espressif/esp-idf!44149
2025-12-15 11:17:08 +08:00
Island 7e5a1bbe5f Merge branch 'change/ble_update_lib_20251202_v5.4' into 'release/v5.4'
change(ble): [AUTO_MR] 20251202 - Update ESP BLE Controller Lib (v5.4)

See merge request espressif/esp-idf!44018
2025-12-15 10:58:50 +08:00
linruihao dad305090f change(bt/bluedroid): Change AVRCP version according to feature enabled
- Version will be set to 1.6 if Cover Art feature enabled
- Otherwise, version will be set to 1.5
2025-12-12 20:11:21 +08:00
Shen Wei Long 5060e2f40d change(ble): Updated the maximum number of concurrent connections to 70 on ESP32-H2
(cherry picked from commit cd33f13521)

Co-authored-by: ShenWeilong <shenweilong@espressif.com>
2025-12-12 15:10:44 +08:00
Jin Chen e71913c5c1 fix(ble): remove target dependency on power control config on ESP32C6
(cherry picked from commit f29f500ac8)

Co-authored-by: cjin <jinchen@espressif.com>
2025-12-12 08:53:05 +08:00
Jin Chen 9133929d4d fix(ble): add soc caps config for pawr feat on ESP32H2
(cherry picked from commit 2eb79c71f1)

Co-authored-by: cjin <jinchen@espressif.com>
2025-12-12 08:53:05 +08:00
Jin Chen acb38fbb07 fix(ble): add soc caps config for pawr feat on ESP32C6
(cherry picked from commit 4e4b863299)

Co-authored-by: cjin <jinchen@espressif.com>
2025-12-12 08:53:05 +08:00
cjin f2ef482efa fix(ble): fix pawr set subevent data length error 2025-12-11 14:22:54 +08:00
Jin Chen 38ba5e030b fix(ble): fix hci log malloc failure crash
(cherry picked from commit 734031311ad8554b600718bf8add68836121f72b)

Co-authored-by: cjin <jinchen@espressif.com>
2025-12-11 14:16:33 +08:00
luoxu 03be9925d6 feat(ble_mesh): update lib commit to 4446669404 2025-12-10 14:38:25 +08:00
Luo Xu 5a0d7bbc7f feat(ble_mesh): add ext log initialization functions
(cherry picked from commit 7b7b9de28d)

Co-authored-by: luoxu <luoxu@espressif.com>
2025-12-10 14:38:25 +08:00
Rahul Tank 17e850fc67 fix(nimble): Add change to cancel sync in case of reattempt 2025-12-06 21:51:46 +05:30
Rahul Tank 7dd41a761f fix(nimble): Add a check for psync before processing 2025-12-05 16:09:29 +05:30
chenjianhua 0567ef5716 feat(ble/nimble): support runtime allocation for mempool 2025-12-05 16:09:29 +05:30
Zhao Wei Liang 099a7bda51 fix(ble): fixed the assert issue when using tinycrypt on ESP32-C2
(cherry picked from commit ac5d14d954)

Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com>
2025-12-05 09:51:38 +08:00
Zhao Wei Liang ab780a2e45 feat(ble): add CONFIG_BT_LE_CTRL_DL_ITVL_PHY_SYNC_EN config on ESP32-C6
(cherry picked from commit 6c4f33798f)

Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com>
2025-12-05 09:51:38 +08:00
Zhao Wei Liang ecc3781c38 feat(ble): add CONFIG_BT_LE_CTRL_DL_ITVL_PHY_SYNC_EN config on ESP32-H2
(cherry picked from commit 5f2825ff37)

Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com>
2025-12-05 09:51:37 +08:00
Zhao Wei Liang ae76300775 change(ble): [AUTO_MR] Update lib_esp32c6 to faf10639
(cherry picked from commit 91810d94b0)

Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com>
2025-12-05 09:51:37 +08:00
Zhao Wei Liang 2a4bd4e258 change(ble): [AUTO_MR] Update lib_esp32h2 to faf10639
(cherry picked from commit 1980d51477)

Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com>
2025-12-05 09:51:35 +08:00
Zhang Hai Peng ee328c7c34 fix(ble/bluedroid): Fix security issues in GATT module
(cherry picked from commit f502b2aab1)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2025-12-03 11:54:13 +08:00
Zhang Hai Peng b3a9afab25 fix(ble/bluedroid): Fix security issues in HCI module
(cherry picked from commit b163685c06)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2025-12-03 11:54:13 +08:00
Zhang Hai Peng 7a367e55c5 fix(ble/bluedroid): Fix security issues in GAP module
(cherry picked from commit 1ed5a4465d)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2025-12-03 11:54:13 +08:00
Zhang Hai Peng 36ad31952c fix(ble/bluedroid): Add length check in prepare write response
(cherry picked from commit b03ff3cf21)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2025-12-03 11:54:12 +08:00
Zhang Hai Peng cfae16dc28 fix(ble/bluedroid): Add boundary check for adv_handle in btm_ble_adv_set_terminated_evt
(cherry picked from commit d2baf3b0d4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2025-12-03 11:54:12 +08:00