radek.tandler
1d8ca0c66b
fix(nvs_flash): fixed cleanup after nvs_set_blob failed on ESP_ERR_NVS_NOT_ENOUGH_SPACE
...
- fixed identification of blob parts to be cleaned by using right starting chunk index
- improved localisation of blobs for cases where some of pages get reclaimed
- created host test cases covering the edge cases above
2026-07-14 17:34:41 +02:00
Euripedes Rocha
7a911c980d
Merge branch 'fix/w5500_rx_buffer_corruption_recovery_v5.3' into 'release/v5.3'
...
fix(esp_eth): recover W5500 RX path on corrupted frame length (v5.3)
See merge request espressif/esp-idf!50649
2026-07-14 14:34:00 +02:00
zhiweijian
bfdb6f5c9e
fix(ble/bluedroid): guard GATT database hash and serialization
2026-07-14 14:59:15 +08:00
Zhi Wei Jian
329c1c8f8e
feat(ble/bluedroid): Support bluedroid dual identity
...
(cherry picked from commit 2358786647 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 14:26:15 +08:00
Rahul Tank
43280d9be8
Merge branch 'bugfix/fix_bond_store_overflow_v5.3' into 'release/v5.3'
...
fix(nimble): Fix bond-store overflow when IRK is enabled (v5.3)
See merge request espressif/esp-idf!50627
2026-07-14 11:17:48 +05:30
Zhi Wei Jian
ebd9ca130e
fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders
...
(cherry picked from commit abbf001120 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:55 +08:00
Zhi Wei Jian
5f7deedd8b
fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure
...
(cherry picked from commit 4fd1ebb4a9 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:54 +08:00
Zhi Wei Jian
f080478455
docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked
...
(cherry picked from commit 34b59d30ae )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:54 +08:00
Zhi Wei Jian
ea9fdcd2e0
fix(ble/bluedroid): fix direct-connect cleanup and adv bounds
...
(cherry picked from commit 82e71c1767 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:54 +08:00
Zhi Wei Jian
1f3d235a9f
fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device
...
(cherry picked from commit 93ab11d564 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:53 +08:00
Zhi Wei Jian
7e677879a6
fix(ble/bluedroid): validate SMP pair-fail reason and OOB device
...
(cherry picked from commit 98efe02385 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:53 +08:00
Zhi Wei Jian
de4598284a
fix(ble/bluedroid): route ATT indication-conf timeout separately
...
(cherry picked from commit 6c3267ee84 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:52 +08:00
Zhi Wei Jian
315ff40e71
fix(ble/bluedroid): validate ATT PDU sizes
...
(cherry picked from commit bb00b9817d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:52 +08:00
Zhi Wei Jian
c3d78e8c66
fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback
...
(cherry picked from commit 37562af0ea )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:52 +08:00
Zhi Wei Jian
80992db5a6
fix(ble/bluedroid): fix GATT long read and Service Changed CCC
...
(cherry picked from commit 4ce692ac0c )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:51 +08:00
Zhi Wei Jian
c5ee2be0ed
fix(ble/bluedroid): validate GATT client discovery handles
...
(cherry picked from commit ac35ae6f2d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:51 +08:00
Zhi Wei Jian
c202b37fa8
fix(ble/bluedroid): cap Read By Type length and free failed service decl
...
(cherry picked from commit 27ff0cf8c7 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:51 +08:00
Zhi Wei Jian
6fa7f4195d
fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling
...
(cherry picked from commit f86739b03d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:50 +08:00
Zhi Wei Jian
a6fed3daae
fix(ble/bluedroid): fix GATT teardown and service-change flow
...
(cherry picked from commit 0645ba469d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:50 +08:00
Zhi Wei Jian
0927c1990d
fix(ble/bluedroid): fix GATT service lifecycle leaks
...
(cherry picked from commit ac93d94958 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:49 +08:00
Zhi Wei Jian
c33e3c13bc
fix(ble/bluedroid): add GATT resource-cleanup helpers
...
(cherry picked from commit b83327f3ca )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:49 +08:00
Zhi Wei Jian
1b3a7a04c2
feat(ble/bluedroid): Support bluedroid LE COC and EATT features
...
(cherry picked from commit 83f0831c53 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 11:56:00 +08:00
Zhang Hai Peng
58a777febf
fix(ble/bluedroid): downgrade numeric comparison log to warning
...
(cherry picked from commit 72a49ed53b )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:37:04 +08:00
Zhang Hai Peng
f6f9236099
fix(ble/bluedroid): preserve ext adv state when set params fails
...
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.
(cherry picked from commit 31bd80fee8 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:37:02 +08:00
Zhang Hai Peng
0b0eaf2db4
fix(ble/bluedroid): reject invalid ATT error code 0x00 on client
...
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.
(cherry picked from commit 1b6f9380f4 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:03 +08:00
Zhang Hai Peng
01066c125b
fix(ble/bluedroid): use sr_cmd status for GATT server error rsp
...
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.
(cherry picked from commit 4c0488d92a )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:03 +08:00
Zhang Hai Peng
2fe6c39b83
fix(ble/bluedroid): match read-multiple-var responses by handle
...
(cherry picked from commit 979c7dc567 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:02 +08:00
Zhang Hai Peng
bc4889662b
fix(ble/bluedroid): match read-multiple responses by handle
...
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.
(cherry picked from commit f91a41510c )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:01 +08:00
Island
9c65614fa5
Merge branch 'fix/ble_mesh_fixed_issues_v5.3' into 'release/v5.3'
...
Resolve reported BLE mesh stack issues (5.3)
See merge request espressif/esp-idf!50404
2026-07-14 10:16:53 +08:00
Guilherme Ferreira
724897ecc2
fix(esp_eth): recover W5500 RX path on corrupted frame length
...
Reject an implausible SPI-read frame-length header and drain the
socket RX buffer to resync Sn_RX_RD, instead of looping forever on
the unrecoverable descriptor and starving the system.
2026-07-10 23:06:13 +00:00
Euripedes Rocha
b6234bb6fc
Merge branch 'fix/sec-347-hostname-null-check_v5.3' into 'release/v5.3'
...
fix(esp_netif): reject NULL hostname in esp_netif_set_hostname_api (SEC_347) (v5.3)
See merge request espressif/esp-idf!50593
2026-07-10 14:14:51 +02:00
Euripedes Rocha Filho
53e0944889
fix(esp_netif): Removes double-free path and NULL dereference in bridge
2026-07-10 14:13:13 +02:00
wuzhenghui
a3515f31fb
fix(esp_hw_support): update memory pointer checks for SPM support
2026-07-10 17:18:42 +08:00
Rahul Tank
dd42e3ced3
fix(nimble): Fix bond-store overflow when IRK is enabled
2026-07-10 13:31:39 +05:30
morris
e11c30437a
Merge branch 'fix/uhci_rx_fsm_v5.3' into 'release/v5.3'
...
fix(uhci): rx fsm race condition (v5.3)
See merge request espressif/esp-idf!50581
2026-07-10 11:22:38 +08:00
Jiang Jiang Jian
f6bad005cf
Merge branch 'change/change_regdma_malloc_caps_v5.3' into 'release/v5.3'
...
change(esp_hw_support): change regdma malloc caps to allow getting memory in the DMA pool (v5.3)
See merge request espressif/esp-idf!50261
2026-07-10 10:28:44 +08:00
David Cermak
2e2d398904
fix(lwip): Adds nullchecks after DHCP server alloc'd pools
2026-07-09 16:09:22 +02:00
David Cermak
3c4d786a2c
fix(lwip): reject invalid DHCP MTU option values
...
Validate MTU from DHCP option 26 against RFC 2132 minimum (68 bytes)
before applying to netif->mtu, preventing rogue DHCP servers from
setting MTU to 0 or other dangerously low values that cause integer
wraparound in IPv4 fragmentation.
2026-07-09 16:09:21 +02:00
Euripedes Rocha Filho
5e65088205
fix(esp_netif): reject NULL hostname in esp_netif_set_hostname_api
...
esp_netif_set_hostname_api() dereferenced hostname via strlen() without
checking it for NULL first, causing a NULL pointer dereference.
2026-07-09 16:08:17 +02:00
Hu Rui
9bcf04ab89
fix(uhci): rx fsm race condition
...
Closes https://github.com/espressif/esp-idf/issues/18746
2026-07-09 19:06:08 +08:00
Zhang Wen Xu
b6860b2db5
Merge branch 'feat/update_openthread_submodule_and_br_lib_20260624_v5.3' into 'release/v5.3'
...
feat(openthread): update openthread submodule (v5.3)
See merge request espressif/esp-idf!50521
2026-07-09 10:16:54 +00:00
wuzhenghui
82712313ea
change(heap): reserve DMA pool with low priority MALLOC_CAP_DEFAULT caps
2026-07-09 17:37:14 +08:00
Jin Cheng
ff88e7a635
fix(bt/bluedroid): fixed stuck sec_state on authention HCI command send failure
...
Closes SEC-1164
2026-07-09 17:20:40 +08:00
Jin Cheng
db6cd2a300
fix(bt/bluedroid): fixed HID host slot leak on local VUP ACL drop
...
Closes SEC-1169
2026-07-09 17:20:40 +08:00
Jin Cheng
70a7fea55f
fix(bt/bluedroid): fixed NULL dereference in remote legacy authentication handler
...
Closes SEC-1143
2026-07-09 17:20:40 +08:00
Jin Cheng
eb9ad41c9b
fix(bt/bluedroid): fixed integer overflow in HID report descriptor parser
...
Closes SEC-084
2026-07-09 17:20:40 +08:00
Jin Cheng
72aaf89016
fix(bt/bluedroid): fixed wrong link key flag cleared on legacy BR/EDR authentication failure
...
Stale bond trust state cound remain after authenticaion failure, causing
incorrect bond status and link key auto-reply behavior.
Closes SEC-1153
2026-07-09 17:20:40 +08:00
Hu Rui
730120e90b
fix(dac): dac_continuous set is_cyclic flag in async mode
2026-07-09 11:21:08 +08:00
Song Ruo Jing
ca2a029722
fix(dma2d): fix non-usable DMA2D_CSC_TX_SCRAMBLE option
2026-07-08 23:03:41 +08:00
Song Ruo Jing and Cursor
278e2c2b41
fix(dma2d): fix race with dma2d_force_end and ISR
...
free_up_channels can only be called once for a started transaction.
Double free will undesirely stop the next picked 2D-DMA transaction on the same channel.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-08 23:03:40 +08:00