Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 10:40:47 +03:00
Code Issues Packages Projects Releases Wiki Activity
45,149 Commits 25 Branches 192 Tags
25b7cbcbe71d24cedc277aaa7e58a8df666b6265
Commit Graph
588 Commits
Author SHA1 Message Date
Island 25b7cbcbe7 Merge branch 'fix/fix_blufi_memory_copy_len_error_v5.4' into 'release/v5.4' 
fix(ble): Fix blufi fragment reassembly bounds and buffer overflows (5.4)

See merge request espressif/esp-idf!48266
 2026-05-12 19:27:41 +08:00
Island 3ff613a06c Merge branch 'bugfix/fix_ble_read_remote_feature_timeout_v5.4' into 'release/v5.4' 
Fixed read remote feature timeout when using coded phy(2f683593) (5.4)

See merge request espressif/esp-idf!48062
 2026-05-12 18:01:40 +08:00
zhiweijian 9e16d6b72e fix(ble): Fixed AI review bugs in bt common 2026-05-12 12:17:05 +08:00
zhanghaipeng aefcf1c2ee fix(ble): Optimize connection interval minimum parameter check 2026-05-11 11:20:14 +08:00
Jin Cheng 945277cbc6 fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid 2026-05-11 09:42:17 +08:00
Jin Cheng cb05dc0b3f fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in Bluedroid 2026-05-11 09:42:17 +08:00
Jin Cheng da54c7e4d8 fix(bt/bluedroid): fixed the vulerabilities from AI code review in SPP 2026-05-11 09:42:14 +08:00
Jin Cheng 0570c13329 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in SPP 2026-05-09 11:21:30 +08:00
Zhang Hai Peng 7dbe28b961 fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(2f683593) 
- Fixed read remote feature timeout when using coded phy
- Fixed disconnection issue(0x08) when using 125k coded phy
- Fixed disconnection issue(0x08) when updating connection param
- Fixed disconnection issue(0x08) when using multi connection
- Avoid error when adding duplicate device to whitelist
- Support disable channel assessment by vendor hci
- Support smaller connection interval (3.75 ms)
- Support duplicate exception list in EVT ADV


(cherry picked from commit 658ff8730b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-04-29 14:53:28 +08:00
yangfeng 87355824ec fix(bt): fix A2DP stack component issues reported by AI review 2026-04-23 16:09:52 +08:00
Jiang Jiang Jian c6f4623fa6 Merge branch 'bugfix/fix_ble_pair_fail_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fix BLE SMP pairing failure on BLE-only devices when using defalut param (5.4)

See merge request espressif/esp-idf!47399
 2026-04-22 15:41:09 +08:00
Wang Meng Yang 7ea2ed1778 Merge branch 'bugfix/btm_sec_free_dev_v5.4' into 'release/v5.4' 
fix(bt): avoid deleting device record on partial transport cleanup (v5.4)

See merge request espressif/esp-idf!47296
 2026-04-20 09:35:02 +08:00
Wang Meng Yang 261307436d Merge branch 'bugfix/ai_review_avrcp_v5.4' into 'release/v5.4' 
fix(bt): fix AVRCP component issues reported by AI review (v5.4)

See merge request espressif/esp-idf!47678
 2026-04-20 09:34:47 +08:00
Wang Meng Yang 7bc820c9b2 Merge branch 'bugfix/oob_in_avrc_v5.4' into 'release/v5.4' 
backport for fix of bug bounty. (v5.4)

See merge request espressif/esp-idf!46838
 2026-04-20 09:31:17 +08:00
Island aee5245e2d Merge branch 'bugfix/fix_some_bluedroid_bugs_260121_v5.4' into 'release/v5.4' 
Bugfix/fix some bluedroid bugs 260121 (5.4)

See merge request espressif/esp-idf!46982
 2026-04-17 18:11:09 +08:00
yangfeng 4ecc25fae1 fix(bt): fix AVRCP component issues reported by AI review 2026-04-16 19:15:08 +08:00
Zhang Hai Peng 3bab1a6895 fix(bt/bluedroid): fix BLE SMP pairing failure on BLE-only devices when using default param 
(cherry picked from commit 74a053bd4e)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-04-09 11:53:22 +08:00
yangfeng de7c3d5e73 fix(bt): avoid deleting device record on partial transport cleanup 2026-04-07 11:55:13 +08:00
zhiweijian 1ced86789b fix(ble/bluedroid): Fixed privacy callback triggering multiple times 2026-04-03 14:07:23 +08:00
zhiweijian d2892e882a fix(ble/bluedroid): Fixed bluedrodi CI build error 2026-03-31 14:32:34 +08:00
zhiweijian 0bd4c9a5ad fix(ble/bluedroid): optimize bluedroid host and fix GAP, memory, status and BTM API issues 
- return HCI_ERR_MEMORY_FULL on cmd buffer alloc failure
- remove legacy adv/scan semaphores and mutex
- Use the same legacy gap callback instead of each independent legacy gap event callback
 2026-03-30 10:49:26 +08:00
Zhi Wei Jian 35ba73a021 fix(ble/bluedroid): Null/range checks, crypto cleanup and API consistency 
- smp_api.h/smp_int.h: SMP_OPCODE_ARRAY_SIZE and SecureConnectionOobDataReply
  declaration alignment
- p_256_ecc_pp/p_256_multprecision: bounds and overflow fixes in ECC/multiprecision
- smp_act: init le_key; p_dev_rec null check in smp_key_distribution;
  smp_compute_dhkey failure notify in smp_both_have_public_keys
- smp_api: early state/cb_evt check in SMP_SecureConnectionOobDataReply
- smp_cmac: input/length validation in cmac_aes_k_calculate and
  aes_cipher_msg_auth_code
- smp_keys: smp_gen_p2_4_confirm return and smp_calculate_comfirm_cont;
  smp_process_private_key/smp_compute_dhkey cleanup and peer_pub_be clear
- smp_l2c: fix callback param types with L2CAP
- smp_main: event/state bounds in smp_sm_event; smp_get_event_name default string
- smp_utils: cmd_code<SMP_OPCODE_ARRAY_SIZE and smp_cmd_build_act check;
  smp_mask_enc_key/smp_command_has_invalid_parameters bounds

(cherry picked from commit 50747e4f63)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-30 10:49:11 +08:00
Zhi Wei Jian f6e48dd5d7 feat(ble/bluedroid): support adv monitor feature 
(cherry picked from commit 1566a50929)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-26 17:23:44 +08:00
Zhi Wei Jian f2e06ca905 fix(ble/bluedroid): BLE credit, reject when p_rcb NULL, timeout and leak fixes 
- l2c_int: align struct/constant types with l2c_ble/l2c_main
- l2c_api: null/state checks in L2CA_SendFixedChnlData
- l2c_ble: reject when p_rcb==NULL, add L2CAP_CMD_BLE_FLOW_CTRL_CREDIT;
  l2cble_init_direct_conn int64_t timeout and link_timeout==0 fix
- l2c_link: null/state checks and cleanup in hci_disc_comp/timeout/send_to_lower
- l2c_main: free p_msg on FCR non-Basic and COC branches; fix LE credit handling;
  process_l2cap_cmd bounds
- l2c_utils: credit/queue cleanup and null checks in l2cu_disconnect_chnl


(cherry picked from commit 16d523e9bf)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 13:58:37 +08:00
Zhi Wei Jian 4bf1770901 fix(ble/bluedroid): Fix double-free, exec write, bounds and HCI param checks 
- gap_ble: add length/attribute checks in gap_proc_write_req
- gatt_cl: set p_cmd->p_cmd=NULL before memset to avoid double-free;
  pending_cl_req %= GATT_CL_MAX_LCB
- gatt_sr: fix exec write zeroed_attrs and offset/len bounds, OOM cleanup
- gatt_sr_hash: null checks for p_attr->p_next, p_data+=2, len==0 in
  gatts_calculate_datebase_hash, gatts_show_local_database
- gatt_utils: explicit return NULL, indent, idx<GATT_MAX_APPS checks,
  len>GATT_MAX_ATTR_LEN, gatt_cleanup_upon_disc dealloc branch
- hciblecmds: length/handle validation in BLE ext adv/BIG sync HCI commands


(cherry picked from commit 1d31286f1a)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 13:58:37 +08:00
Zhi Wei Jian 695be6cff2 fix(ble/bluedroid): Event length checks and timer/alarm error handling 
- btu_hcif: validate p_msg->len and hci_evt_len in process_event; pass evt_len to
  sub-handlers; fix cs_subevt num_steps_reported==0 malloc; bounds in
  command_complete and role_change_evt
- btu_task: handle osi_alarm_new/hash_map_set failure in btu_start_timer,
  btu_start_quick_timer, btu_start_timer_oneshot


(cherry picked from commit 537661fb2e)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 13:58:36 +08:00
Zhi Wei Jian c03a27565c fix(ble/bluedroid): BLE GAP/ACL/ISO/SCO null checks, evt_len and resource handling 
- btm_acl: malloc/list_append failure handling, remove/memset order in btm_acl_removed
- btm_ble: remove incorrect sec_flags in SMP_OOB/NC/SC_OOB fall-through
- btm_ble_5_gap: btm_ble_hci_status_to_str unreachable return,
  BTM_BleSetExtendedAdvParams/BleStartExtAdv leak and bounds
- btm_ble_addr: fix indent in btm_find_dev_by_identity_addr
- btm_ble_gap: null check p_service_data, pass evt_len to btm_ble_process_adv_pkt,
  bounds in process_adv_pkt
- btm_ble_iso: align param types with declaration
- btm_ble_privacy: handle BTM_BLE_IRK_LIST_INVALID_INDEX in update_resolving_list,
  comment fixes
- btm_devctl: fix btm_vsc_complete param order/type
- btm_sco: add evt_len to btm_sco_process_num_completed_pkts for bounds check
- btm_ble_int.h/btm_int.h: add evt_len to process_adv_pkt and
  process_num_completed_pkts declarations


(cherry picked from commit 65b2cb2728)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 13:58:36 +08:00
Zhi Wei Jian f34c9d5b73 fix(ble/bluedroid): fix L2CAP, SMP and HCI command issues 
- Fix active_count check in l2cu_ble_plcb_active_count
- Restore previous state if connection command fails
- Fix HCI cmd buffer size off-by-one errors
- Fix connect handle length errors
- Fix channel sounding event status handling
- Fix SMP param_len check in smp_rand_back
- Fix spelling: BROCASTER to BROADCASTER in definitions



(cherry picked from commit e118d053b3)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 10:27:35 +08:00
Zhi Wei Jian 9cebea1dba fix(ble/bluedroid): fix GAP, advertising and security issues in BTM layer 
- Fix adv state restore and reset if start/stop failed
- Fix periodic adv v2 event without PAWR feature enabled
- Fix periodic adv sync establish skip handling
- Fix resolving list max_size validation
- Fix RPA addr_type update after host-side resolution
- Fix pairing_state reset if p_dev_rec alloc failed
- Fix ISO cis_cnt limit and ext adv parameter check
- Try to delete smp keys even if not in device list



(cherry picked from commit e0ccc644a8)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 10:27:34 +08:00
Zhi Wei Jian f2f62587d6 fix(ble/bluedroid): fix GATT protocol and database operation issues 
- Fix GATTC read by type length error and rsp pdu format check
- Fix p_cur_handle update in gatts_db_read_attr_value_by_type
- Fix len calculation error in calculate_database_info_size
- Replace gatt_find_the_connected_bda with p_tcb_list iteration
- Send cmd reject if cid is invalid
- Fix param_len check in smp_rand_back
- Remove duplicate uuid compare functions



(cherry picked from commit 6242e0244c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-25 10:27:34 +08:00
Jin Cheng 56053c4d1f fix(bt/bluedroid): fixed possible OOB read in avrc_pars_vendor_cmd 2026-03-20 20:14:01 +08:00
yangfeng 23a7b191ca feat(bt): Add APIs to control transmit power level 
- API to read ACL real RSSI
- APIs to read/write tx power of inq/iscan/page/pscan/ACL
 2026-03-16 15:45:51 +08:00
yangfeng 01fb000eb6 fix(hid): Fixed HID repeatedly reporting the close event 2026-03-15 13:13:12 +08:00
chenjianhua f35659e032 feat(ble/bluedroid): Add an API to resolve RPA 2026-03-11 20:11:24 +08:00
Zhi Wei Jian 3b5a95b0ae fix(ble/bluedroid): Fixed read or write failed if SMP is disabled 
(cherry picked from commit 124f275bdf839b855e6af0cfb9d197f11c9a766c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-03-02 10:04:19 +08:00
zhiweijian a49de4da52 fix(ble/bluedroid): Unify BTM byte alignment 2026-01-30 20:15:38 +08:00
zhiweijian dd35a4eaef feat(ble/bluedroid): Add new bluedroid host examples 2026-01-30 20:14:59 +08:00
Jin Cheng 735ab37a2f fix(bt): enhanced packet length check in sdp_server.c 2026-01-20 13:02:12 +08:00
Jin Cheng 1226e99d09 fix(bt): enhanced packet length check for avrc_pars_vendor_cmd 2026-01-20 13:02:12 +08:00
Zhou Xiao 983b4b9de5 fix(ble): fixed use-after-free in bluedroid attp 
(cherry picked from commit 78594e0f6e)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
 2026-01-15 19:13:22 +08:00
Wang Meng Yang 67265547ba Merge branch 'bugfix/l2cap_malloc_fail_v5.4' into 'release/v5.4' 
fix(bt): fix l2cap malloc fail in throughput test(v5.4)

See merge request espressif/esp-idf!44851
 2026-01-14 20:05:40 +08:00
zhanghaipeng 01fc843a33 feat(ble/bluedroid): add periodic advertising create sync retry mechanism 2026-01-09 14:11:17 +08:00
Zhang Hai Peng d069b07c32 fix(ble/bluedroid): Fix multiple out-of-bounds read vulnerabilities in GATT PDU handlers 
(cherry picked from commit 643d9c2387)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-01-09 14:09:16 +08:00
Zhang Hai Peng 041af013e5 fix(ble/bluedroid): Fix out-of-bounds read in l2cble_process_sig_cmd 
(cherry picked from commit 93cfbb8522)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-01-09 14:09:16 +08:00
Zhang Hai Peng 1f8d6813fe fix(ble/bluedroid): Fix integer underflow in gatt_process_read_by_type_rsp 
(cherry picked from commit 597fc6e5c1)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-01-09 14:09:16 +08:00
xiongweichao 62853636df fix(bt): fix l2cap malloc fail in throughput test 2026-01-09 06:05:02 +00:00
Zhi Wei Jian 5026daf6c3 fix(ble/bluedroid): Fixed bluedroid host get white list size error 
(cherry picked from commit f4dfd42725)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-01-07 17:24:15 +08:00
Zhi Wei Jian f59bff13ee fix(ble/bluedroid): Fixed bt buuld error 
fix(ble/bluedroid): disable power management if bt is disabled


(cherry picked from commit 6f27074c1e)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-01-07 17:24:15 +08:00
Zhi Wei Jian 1b29279016 fix(ble/bluedroid): optimize bluedroid host code 
(cherry picked from commit 3b18da2bde)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-01-07 17:24:14 +08:00
Zhi Wei Jian d80ad53deb fix(ble/bluedroid): Add BLE_TOPOLOGY_CHECK 
(cherry picked from commit 728c4c8a10)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-01-07 17:24:13 +08:00