Jin Cheng
d6e6b14236
fix(bt/bluedroid): fixed potential OOB read in the reporting handler
...
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-19 11:19:23 +08:00
Jin Cheng
5bc344f900
fix(bt/bluedroid): fixed a potential overflow about the media payload offset
...
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-19 11:19:23 +08:00
Jin Cheng
3619e43002
fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open
2025-12-19 11:19:23 +08:00
Jin Cheng
f7058fa32e
fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected
2025-12-19 11:19:23 +08:00
Jin Cheng
0028cb326a
fix(bt/bluedroid): reject device with same address in legacy paring
2025-12-19 11:19:23 +08:00
Jin Cheng
073965fd31
fix(bt/bluedroid): ignore AVCT commands that are too long
2025-12-19 11:19:23 +08:00
Jin Cheng
648f0396b8
fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP
2025-12-19 11:19:23 +08:00
Jin Cheng
0b8f1f0b0c
fix(bt/bluedroid): make sure SDP only start discovery once
2025-12-19 11:19:23 +08:00
Jin Cheng
44b566ab5e
fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write
2025-12-19 11:19:23 +08:00
Jin Cheng
bcdca970d4
fix(bt/blurdoird): check Classic key before cross-key derivation
2025-12-19 11:19:23 +08:00
Jin Cheng
8e354a7541
fix(bt/blurdoird): enable bitpool snity checks
2025-12-19 11:19:23 +08:00
Luo Xu
9592fcf3e2
fix(ble_mesh): fixed incorrect rpl behavior in transport enh
...
(cherry picked from commit 29a722296f )
Co-authored-by: luoxu <luoxu@espressif.com >
2025-12-18 17:43:14 +08:00
Zhou Xiao
7ea4ce9e00
fix(ble): added missed spin lock initialization
...
(cherry picked from commit 069262e513 )
Co-authored-by: Zhou Xiao <zhouxiao@espressif.com >
2025-12-18 17:13:37 +08:00
luoxu
84d7f85fdd
feat(ble_mesh): dfd client/server supported
2025-12-18 16:28:29 +08:00
luoxu
eebead3c3f
fix(bt): Fixed the issue of duplicate MAX macro definitions
2025-12-18 16:15:44 +08:00
luoxu
01e214c0a5
feat(ble_mesh): Adapt DFU/MBT to esp-idf
2025-12-18 16:15:44 +08:00
luoxu
85f2e2b89d
feat(ble_mesh): Device Firmware Update (Zephyr v4.0.0)
2025-12-18 16:15:44 +08:00
Island
fb68633d78
Merge branch 'bugfix/fix_bt_4205_v5.4' into 'release/v5.4'
...
Fixed BLE assert lld_con.c 1479 on ESP32-C3 and ESP32-S3(5106725) (v5.4)
See merge request espressif/esp-idf!44327
2025-12-18 11:30:55 +08:00
Island
c678100216
Merge branch 'bugfix/fix_ble_security_issue_2025_v5.4' into 'release/v5.4'
...
Fix potential CVE-2024-0039 out-of-bounds write in attp_build_value_cmd (v5.4)
See merge request espressif/esp-idf!43806
2025-12-18 10:55:49 +08:00
Island
fafa8211cc
Merge branch 'bugfix/fix_reconnect_failed_with_extend_adv_v5.4' into 'release/v5.4'
...
fix(ble/bluedroid): Fixed the issue that extend advertising might not restart if the connection fails (v5.4)
See merge request espressif/esp-idf!44250
2025-12-18 10:51:23 +08:00
Rahul Tank
86c8597589
Merge branch 'bugfix/fix_compile_tinycrypt_v5.4' into 'release/v5.4'
...
fix(nimble): Add missing header file to fix compilation issue (v5.4)
See merge request espressif/esp-idf!43886
2025-12-17 12:33:18 +05:30
Chen Jian Hua
617f91cc0b
fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(5106725)
...
- Fixed BLE assert lld_con.c 1479
(cherry picked from commit 22641241fa )
Co-authored-by: chenjianhua <chenjianhua@espressif.com >
2025-12-17 12:53:54 +08:00
Rahul Tank
951a19762b
fix(nimble): Add missing header file to fix compilation issue
2025-12-16 12:17:19 +05:30
Jin Cheng
57a0937abd
fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf
2025-12-16 11:39:21 +08:00
Zhi Wei Jian
23caa76a40
fix(ble/bluedroid): Fixed reconnection failed with extend adv
...
(cherry picked from commit ec4052c1c7 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2025-12-15 21:23:24 +08:00
Island
16653c2499
Merge branch 'fix/fix_pawr_crash_errors_v5.4' into 'release/v5.4'
...
Fix/fix pawr crash errors (v5.4)
See merge request espressif/esp-idf!43943
2025-12-15 14:21:43 +08:00
Island
e7820291d4
Merge branch 'fix/add_soc_caps_for_pawr_feat_v5.4' into 'release/v5.4'
...
fix(ble): add soc caps feat for PAwR (v5.4)
See merge request espressif/esp-idf!44149
2025-12-15 11:17:08 +08:00
Island
7e5a1bbe5f
Merge branch 'change/ble_update_lib_20251202_v5.4' into 'release/v5.4'
...
change(ble): [AUTO_MR] 20251202 - Update ESP BLE Controller Lib (v5.4)
See merge request espressif/esp-idf!44018
2025-12-15 10:58:50 +08:00
linruihao
dad305090f
change(bt/bluedroid): Change AVRCP version according to feature enabled
...
- Version will be set to 1.6 if Cover Art feature enabled
- Otherwise, version will be set to 1.5
2025-12-12 20:11:21 +08:00
Shen Wei Long
5060e2f40d
change(ble): Updated the maximum number of concurrent connections to 70 on ESP32-H2
...
(cherry picked from commit cd33f13521 )
Co-authored-by: ShenWeilong <shenweilong@espressif.com >
2025-12-12 15:10:44 +08:00
Jin Chen
e71913c5c1
fix(ble): remove target dependency on power control config on ESP32C6
...
(cherry picked from commit f29f500ac8 )
Co-authored-by: cjin <jinchen@espressif.com >
2025-12-12 08:53:05 +08:00
Jin Chen
9133929d4d
fix(ble): add soc caps config for pawr feat on ESP32H2
...
(cherry picked from commit 2eb79c71f1 )
Co-authored-by: cjin <jinchen@espressif.com >
2025-12-12 08:53:05 +08:00
Jin Chen
acb38fbb07
fix(ble): add soc caps config for pawr feat on ESP32C6
...
(cherry picked from commit 4e4b863299 )
Co-authored-by: cjin <jinchen@espressif.com >
2025-12-12 08:53:05 +08:00
cjin
f2ef482efa
fix(ble): fix pawr set subevent data length error
2025-12-11 14:22:54 +08:00
Jin Chen
38ba5e030b
fix(ble): fix hci log malloc failure crash
...
(cherry picked from commit 734031311ad8554b600718bf8add68836121f72b)
Co-authored-by: cjin <jinchen@espressif.com >
2025-12-11 14:16:33 +08:00
luoxu
03be9925d6
feat(ble_mesh): update lib commit to 4446669404
2025-12-10 14:38:25 +08:00
Luo Xu
5a0d7bbc7f
feat(ble_mesh): add ext log initialization functions
...
(cherry picked from commit 7b7b9de28d )
Co-authored-by: luoxu <luoxu@espressif.com >
2025-12-10 14:38:25 +08:00
Rahul Tank
17e850fc67
fix(nimble): Add change to cancel sync in case of reattempt
2025-12-06 21:51:46 +05:30
Rahul Tank
7dd41a761f
fix(nimble): Add a check for psync before processing
2025-12-05 16:09:29 +05:30
chenjianhua
0567ef5716
feat(ble/nimble): support runtime allocation for mempool
2025-12-05 16:09:29 +05:30
Zhao Wei Liang
099a7bda51
fix(ble): fixed the assert issue when using tinycrypt on ESP32-C2
...
(cherry picked from commit ac5d14d954 )
Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com >
2025-12-05 09:51:38 +08:00
Zhao Wei Liang
ab780a2e45
feat(ble): add CONFIG_BT_LE_CTRL_DL_ITVL_PHY_SYNC_EN config on ESP32-C6
...
(cherry picked from commit 6c4f33798f )
Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com >
2025-12-05 09:51:38 +08:00
Zhao Wei Liang
ecc3781c38
feat(ble): add CONFIG_BT_LE_CTRL_DL_ITVL_PHY_SYNC_EN config on ESP32-H2
...
(cherry picked from commit 5f2825ff37 )
Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com >
2025-12-05 09:51:37 +08:00
Zhao Wei Liang
ae76300775
change(ble): [AUTO_MR] Update lib_esp32c6 to faf10639
...
(cherry picked from commit 91810d94b0 )
Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com >
2025-12-05 09:51:37 +08:00
Zhao Wei Liang
2a4bd4e258
change(ble): [AUTO_MR] Update lib_esp32h2 to faf10639
...
(cherry picked from commit 1980d51477 )
Co-authored-by: zhaoweiliang <zhaoweiliang@espressif.com >
2025-12-05 09:51:35 +08:00
Zhang Hai Peng
ee328c7c34
fix(ble/bluedroid): Fix security issues in GATT module
...
(cherry picked from commit f502b2aab1 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2025-12-03 11:54:13 +08:00
Zhang Hai Peng
b3a9afab25
fix(ble/bluedroid): Fix security issues in HCI module
...
(cherry picked from commit b163685c06 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2025-12-03 11:54:13 +08:00
Zhang Hai Peng
7a367e55c5
fix(ble/bluedroid): Fix security issues in GAP module
...
(cherry picked from commit 1ed5a4465d )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2025-12-03 11:54:13 +08:00
Zhang Hai Peng
36ad31952c
fix(ble/bluedroid): Add length check in prepare write response
...
(cherry picked from commit b03ff3cf21 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2025-12-03 11:54:12 +08:00
Zhang Hai Peng
cfae16dc28
fix(ble/bluedroid): Add boundary check for adv_handle in btm_ble_adv_set_terminated_evt
...
(cherry picked from commit d2baf3b0d4 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2025-12-03 11:54:12 +08:00