Jin Cheng
bdfb0f9e1d
fix(bt/bluedroid): add status management for audio sink service channel
2026-01-15 09:12:31 +08:00
Jin Cheng
aced53e693
fix(bt/controller): fixed wrong key type during changing connection link key
2026-01-09 18:13:06 +08:00
Jin Cheng
66b2214a0d
fix(bt/bluedroid): cleaned the code according to the tool cppcheck
2025-12-19 16:56:25 +08:00
Jin Cheng
cf5a568dc0
fix(bt/bluedroid): fixed possible OOB read in smp_br_data_received
2025-12-19 16:52:31 +08:00
Jin Cheng
8fe4c35994
fix(bt/bluedroid): drop connection when atttempting to disable encryption
2025-12-19 16:52:31 +08:00
Jin Cheng
991486fa02
fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd
2025-12-19 16:52:31 +08:00
Jin Cheng
fa22e34f56
fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl
2025-12-19 16:52:31 +08:00
Jin Cheng
5872a8cccb
fix(bt/bluedroid): fixed an OOB bug in bta_av_setconfig_rej
2025-12-19 16:52:31 +08:00
Jin Cheng
f7c0f92556
fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete
2025-12-19 16:52:31 +08:00
Jin Cheng
514bcb41a2
fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete
2025-12-19 16:52:31 +08:00
Jin Cheng
04219e5fd4
fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete
2025-12-19 16:52:31 +08:00
Jin Cheng
08a593d801
fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete
2025-12-19 16:52:31 +08:00
Jin Cheng
a73e2e4d6c
fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete
2025-12-19 16:52:31 +08:00
Jin Cheng
5a2b29fe82
fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute
2025-12-19 16:52:31 +08:00
Jin Cheng
3ec5f615ae
fix(bt/bluedroid): report failure when not able to connect to AVRCP
2025-12-19 16:52:31 +08:00
Jin Cheng
56756b1b5d
fix(bt/bluedroid): fixed buffer overflow in BRSF
2025-12-19 16:52:31 +08:00
Jin Cheng
11eea1b4de
fix(bt/bluedroid): added negative length check in process_service_search_rsp
2025-12-19 16:52:31 +08:00
Jin Cheng
be25062b0d
fix(bt/bluedroid): fixed OOB read in SDP server continuation length
2025-12-19 16:52:31 +08:00
Jin Cheng
4df287c536
fix(bt/bluedroid): added length check when copy AVDTP packet
2025-12-19 16:52:31 +08:00
Jin Cheng
6a497ad921
fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET
2025-12-19 16:52:31 +08:00
Jin Cheng
019516284f
fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item
2025-12-19 16:52:31 +08:00
Jin Cheng
158519cf8c
fix(bt/bluedroid): added boundary check when reading SDP attribute response packet
2025-12-19 16:52:31 +08:00
Jin Cheng
173747750d
fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp
2025-12-19 16:52:31 +08:00
Jin Cheng
4cb6ccc6f6
fix(bt/bluedroid): fixed potential OOB read in the reporting handler
...
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-19 16:52:31 +08:00
Jin Cheng
f15fe75f24
fix(bt/bluedroid): fixed a potential overflow about the media payload offset
...
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-19 16:52:31 +08:00
Jin Cheng
15e0c748e5
fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open
2025-12-19 16:52:31 +08:00
Jin Cheng
70f82a5607
fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected
2025-12-19 16:52:31 +08:00
Jin Cheng
5b7c17cfc7
fix(bt/bluedroid): reject device with same address in legacy paring
2025-12-19 16:52:31 +08:00
Jin Cheng
0fc2109ec7
fix(bt/bluedroid): ignore AVCT commands that are too long
2025-12-19 16:52:31 +08:00
Jin Cheng
9095d1cd25
fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP
2025-12-19 16:52:31 +08:00
Jin Cheng
0f1c203e12
fix(bt/bluedroid): make sure SDP only start discovery once
2025-12-19 16:52:31 +08:00
Jin Cheng
1ba8aaaff8
fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write
2025-12-19 16:52:31 +08:00
Jin Cheng
33af3a0aa6
fix(bt/blurdoird): check Classic key before cross-key derivation
2025-12-19 16:52:31 +08:00
Jin Cheng
e7e0be698a
fix(bt/blurdoird): enable bitpool snity checks
2025-12-19 16:52:31 +08:00
Jin Cheng
b70e8ae903
fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf
2025-12-16 11:38:55 +08:00
Jin Cheng
9889edd799
fix(bt/blurdoird): fixed an OOB write in bta_dm_sdp_result
2025-11-27 23:04:36 +08:00
Jin Cheng
051de7d578
fix(bt/controller): Fixed some controller bugs
...
- Fixed Bluetooth hardware error of 'CHMAP_ERROR'
- Fixed encryption collision bug
2025-11-13 19:46:56 +08:00
JinCheng
79ae28fbb7
fix(bt/bluedroid): update the COD before enabling inquiry scan
2025-11-11 16:17:30 +08:00
Jin Cheng
b9ba1e29b6
fix(bt/bluedroid): fixed potential OOB in AVRCP vendor command composition
2025-10-28 10:17:04 +08:00
Jin Cheng
53a1c66d41
fix(bt/controller): fixed several controller bugs
2025-10-16 10:25:34 +08:00
Jin Cheng
b4854cab63
fix(bt/controller): fixed the sniff anchor point can be mismatch from central and peripheral
2025-10-16 10:25:34 +08:00
JinCheng
c3efac4608
fix(bluedroid): removed the code relying on compiler-specific extension for FAM in union
2025-09-27 11:31:05 +08:00
JinCheng
999710fccf
fix(bt/bluedroid): fixed potential OOB in Bluedroid
2025-09-26 17:28:55 +08:00
JinCheng
86a9b4ff9e
fix(bt/controller): fixed some controller bugs
2025-08-27 11:08:36 +08:00
JinCheng
ccd0d369aa
fix(esp_phy): update esp32 librtc.a for coex problems
...
- ESP32 phy_version: 4861, b71b5ad, Aug, 5 2025
- ESP32 librtc version: 6758f983, Mar 22 2024, 13:39:26
2025-08-08 23:14:47 +08:00
JinCheng
f0f7ec705e
fix(bt/bluedroid): safe string returns and cleanups for bt_discovery example
2025-07-31 21:08:24 +08:00
Jin Cheng
b1ea7f7ae6
fix(bt/controller): update libbtdm_app.a
...
- fixed errors in the coexistance of ACL and SCO
- fixed dynamic priority config error in dual mode
2025-04-18 07:43:24 +08:00
Jin Cheng
cd8fa5c46f
fix(bt/bluedroid): fixed memory leaks in SPP callback mode
2025-02-26 19:12:47 +08:00
Jin Cheng
309747bf9a
fix(bt/controller): fixed some controller bugs on ESP32.
...
1. added a VSC to control whether to initiate lmp_auto_rate
- Closes https://github.com/espressif/esp-idf/issues/15133
2. fixed EA resource cleanup error after SNIFF negotiation failure
- Closes https://github.com/espressif/esp-idf/issues/13605
3. removed an assertion in SCO data TX handler after disconnection
- Closes https://github.com/espressif/esp-idf/issues/15176
2025-02-26 16:31:06 +08:00
Jin Cheng
eb68ef4cc1
fix(bt/controller): fixed missing critical protections on linked-list structure of (e)SCO buffers
2025-01-07 18:56:23 +08:00
Jin Cheng
185b4d9d44
fix(bt/bluedroid): fixed access NULL in HFP callback handler
2024-12-05 13:19:18 +08:00
Jin Cheng
5e0a73bc56
fix(bt/controller): Fixed some bugs on esp32 controller
...
- Added VSC to update local Bluetooth clock
- Added critical protection for the free method for sync buffers
- Fixed zero attempt value set by role switch
2024-11-26 18:03:11 +08:00
Jin Cheng
fdcf89ae6b
feat(bt/bluedroid): added events to indicate the profile states of HFP
2024-11-22 17:14:16 +08:00
Jin Cheng
2b334d1dfa
fix(bt/bluedroid): disconnect SDP connection on receiving incorrect response
2024-11-20 08:20:40 +08:00
Jin Cheng
cfdefd3e03
fix(bt/controller): Fixed some controller bugs on ESP32
...
- Fixed wrong logic in handling sniff transaction collision at slave
side
- Fixed the issue ACL is stopped too early before eSCO
2024-11-08 12:53:56 +08:00
Jin Cheng
c79eb0d5bf
fix(bt/bluedroid): AG should send OK or other error codes to HF client
...
when it is driven by HF to initiate a call.
2024-11-08 12:51:00 +08:00
Jin Cheng
e2241f1fc1
fix(bt/controller): Fixed some controller bugs on ESP32
...
- Fixed access NULL in SCO frame end
Closes https://jira.espressif.com:8443/browse/IDFGH-10796
- Added LAP checking for Periodic Inquiry
- Removed an inproper assertion in SCO module
- Fixed wrong logic in key exchange when
LMP transaction collision occurred
- Fixed the using of wrong error code in
the transaction collision of role switch
2024-10-12 09:01:48 +08:00
Jin Cheng
9872a7bbd1
fix(bt/bluedroid): fixed AG and HF client cannot enter/exit sniff mode
2024-10-10 16:23:09 +08:00
Jin Cheng
6d85d86fe1
Revert "Disable sniff mode during (e)SCO connection."
...
This reverts commit 39a5eb84f3 .
2024-10-10 16:10:11 +08:00
Jin Cheng
22fad3f0a8
fix(bt/controller): Fixed some controller bugs on ESP32
...
- Fixed access NULL in SCO frame end
Closes https://jira.espressif.com:8443/browse/IDFGH-10796
- Added LAP checking for Periodic Inquiry
- Removed an inproper assertion in SCO module
- Fixed wrong logic in key exchange when
LMP transaction collision occurred
- Fixed the using of wrong error code in
the transaction collision of role switch
2024-09-23 15:33:11 +08:00
Jin Cheng
3964fb1fa8
fix(bt/controller): Removed an improper assertion in ACL link driver
...
- See more from jira BT-3591
2024-07-12 19:35:18 +08:00
Jin Cheng
b79fcbb9d7
fix(bt/controller): Parse out the correct packet types from Host parameters
...
- For HCI command HCI_Enhanced_Setup_Synchronous_Connection
2024-04-30 17:38:58 +08:00
Jin Cheng
081dc80eb8
fix(bt/bluedroid): allocate memory for control block of HFP Audio Gateway in its initialization when dynamic memory is wnabled
2024-04-15 11:20:55 +08:00
Jin Cheng
98230244df
fix(bt/controller): Use embedded assembly to get access to DPORT registers
2024-04-01 18:53:47 +08:00
Jin Cheng
82542d2e96
feat(bt/bluedroid): added a VSC to set minimal encryption key size
2024-03-25 10:50:06 +08:00
Jin Cheng
45af060963
change(bt/bluedroid): Use BTC util to convert HCI status to ESP status
2024-03-20 10:38:44 +08:00
Jin Cheng
cdb2f2c570
fix(bt/controller): Fixed 3 esp32 bt controller bugs
...
update esp32 bt-lib (952debf4)
1. Increased the length of queue for coexist requestions
2. fix(bt/controller): Cleared BT SNIFF when no connections exists
3. fix(bt/controller): Corrected a typo in coex module
2024-02-29 11:02:37 +08:00
Jin Cheng
f4f26e94bd
feat(bt/bluedroid): Moved the memory allocation of HF AG control blocks to BTC module
2024-02-28 20:30:38 +08:00
Jin Cheng
20f2207d5f
Merge branch 'bugfix/mem_leak_op_dev_name' into 'master'
...
fix(bt/bluedroid): Avoided possible memory leak in the module of BT device
See merge request espressif/esp-idf!29141
2024-02-28 15:54:24 +08:00
Jin Cheng
a288640655
fix(bt/bluedroid): Avoided possible memory leak in the module of BT device
2024-02-23 14:14:50 +08:00
Jin Cheng
057eb7061d
feat(bt/bluedroid): Added an event to notify the encryption mode to applicaiton layer
2024-01-05 09:40:38 +08:00
Jin Cheng
8582f9bedf
fix(bt/bluedroid): corrected the strings of A2DP audio states
2024-01-04 17:52:11 +08:00
Jin Cheng
6ee9b95960
feat(bt/bluedroid): Added report for the type of link key in ESP_BT_GAP_AUTH_CMPL_EVT
2023-12-29 16:22:04 +08:00
Jin Cheng
42f19d657a
docs(bt/bluedroid): update API documents of SPP
2023-12-26 09:13:20 +08:00
Jin Cheng
a3f68aef8a
feat(bt/bluedroid): Added API to get local device name
2023-12-15 19:30:12 +08:00
Jin Cheng
e1a5122dbc
Merge branch 'fix/build_error_in_compiler_performance_mode' into 'master'
...
fix(bt/bluedroid): fixed build error when compiler in performace mode
Closes IDFGH-11637
See merge request espressif/esp-idf!27816
2023-12-12 18:56:42 +08:00
Jin Cheng
e78209ad47
fix(bt/bluedroid): Disabled Sniff Subrating temporarily as it did not work well
2023-12-05 20:10:03 +08:00
Jin Cheng
58256d8c4b
fix(bt/bluedroid): Changed the default air mode to invalid value
2023-12-05 20:10:03 +08:00
Jin Cheng
dba328d9d5
fix(bt/bluedroid): Removed redundant operation of SCO clean up
2023-12-05 20:10:03 +08:00
Jin Cheng
0f9e8687ee
fix(bt/bluedroid): Corrected the definitions of HF Client callback events
2023-12-05 20:10:00 +08:00
Jin Cheng
48d410e10d
fix(bt/bluedroid): Set the alarm_arg to NULL after releasing to avoid double free in l2cap
2023-11-30 19:47:57 +08:00
Jin Cheng
823e0711c9
fix(bt/bluedroid): Set the alarm_arg to NULL after releasing to avoid double free
2023-11-29 15:55:46 +08:00
Jin Cheng
57e3e97497
fix(bt/bluedroid): Avoided crash of LoadProhibited during HFP AG deinitialization
...
Move the release of the control blocks from the start
of deinitialization to the profile disabled event.
2023-11-17 09:39:46 +08:00
Jin Cheng
eab9037b1c
fix(bt/bluedroid): Added dynamic memory allocation for HFP control blocks
2023-11-16 20:10:29 +08:00
Jin Cheng
f5c15be581
fix(bt/bluedroid): corrected the API documents of profile HFP and A2DP
2023-11-15 15:34:27 +08:00
Jin Cheng
4edd531fe3
fix(bt/bluedroid): Added some argument check in APIs of HFP AG
2023-11-15 15:18:22 +08:00
Jin Cheng
97e9eb5ca8
fix(bt/bluedroid): Fix the crash of invalid access to released resources
...
It is caused by the delayed timer is alarmed after esp_spp_deinit.
2023-11-15 02:12:14 +00:00
Jin Cheng
46327936cb
feat(bt/bluedroid): Added an API to specify data types for ACL-U traffic
2023-11-02 17:43:04 +08:00
Jin Cheng
1f2a1564a2
feat(bt/bluedroid): Support to build HID Host and HID Device in single binary
2023-11-01 16:54:11 +08:00
Jin Cheng
b319143e3b
feat(bt/bluedroid): Added bt_discovery based host only example
2023-10-30 00:52:26 +00:00
Jin Cheng
fc174f5811
feat(bt/bluedroid): Added mode to use BlueDroid host only without Bluetooth Controller
2023-10-30 00:52:26 +00:00
Jin Cheng
d0e0928138
feat(bt/Bluedroid): Implemented esp_coex_status_set/clear using vendor HCI
2023-09-13 10:55:04 +08:00
Jin Cheng
3fb242660d
fix(bt/controller): Fixed error in sniff negotiation
...
fix(bt/controller): Avoided both local and peer unsniff being triggered
fix(bt/controller): Fixed the crash of mixing of master- and slave-initiated sniff requests
fix(bt/controller): Moved the TX of HW_ERR_EVT out of interrupt context to thread context
fix(bt/controller): Fixed the issue rx_irq is generated after error_irq for slave sniff mode frame
fix(bt/controller): Fixed asser error resulted from failure of role switch frame insert
fix(bt/controller): Ignored rx_irq in inquiry scan frame end
fix(bt/controller): Ignored rx_irq in page scan frame end
fix(bt/controller): Added status check before set/clear sniff coex status
fix(bt/controller): Fixed IntegerDevideByZero caused by interrupted r_ld_sco_start
2023-09-12 12:20:50 +00:00
Jin Cheng
62f6af0dd7
fix(bt/bluedroid): Fixed incorrect arrangement in type esp_hf_dial_type_t
2023-09-12 06:53:11 +00:00
Jin Cheng
024862c76f
change(bt/bluedroid): Added line information printing when error occurs CHECK_HF_IDX
2023-09-12 06:53:11 +00:00
Jin Cheng
9fed90bbb4
fix(bt/bluedroid): Fixed the issue of uninitialized parameters in event BTA_AG_WBS_EVT
2023-09-12 06:53:11 +00:00
Jin Cheng
cde05ef495
fix(bt/bluedroid): Deleted the redundant 'memset' in btc_hf_cb_handler
2023-08-31 19:44:37 +08:00
Jin Cheng
0a03f7e03a
docs(bt/bluedroid): Changed the description of esp_hf_client_reject_call
2023-08-30 17:27:13 +08:00
Jin Cheng
2668df265e
fix(bt/bluedroid): Fixed invalid access to freed semaphore
2023-08-30 17:27:13 +08:00
Jin Cheng
fbb69daaaa
fix(bt/bluedroid): Fixed wrong indexes of HF-AG indicators
2023-08-30 17:27:13 +08:00