Commit Graph
100 Commits
Author SHA1 Message Date
Jin Cheng bdfb0f9e1d fix(bt/bluedroid): add status management for audio sink service channel 2026-01-15 09:12:31 +08:00
Jin Cheng aced53e693 fix(bt/controller): fixed wrong key type during changing connection link key 2026-01-09 18:13:06 +08:00
Jin Cheng 66b2214a0d fix(bt/bluedroid): cleaned the code according to the tool cppcheck 2025-12-19 16:56:25 +08:00
Jin Cheng cf5a568dc0 fix(bt/bluedroid): fixed possible OOB read in smp_br_data_received 2025-12-19 16:52:31 +08:00
Jin Cheng 8fe4c35994 fix(bt/bluedroid): drop connection when atttempting to disable encryption 2025-12-19 16:52:31 +08:00
Jin Cheng 991486fa02 fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd 2025-12-19 16:52:31 +08:00
Jin Cheng fa22e34f56 fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl 2025-12-19 16:52:31 +08:00
Jin Cheng 5872a8cccb fix(bt/bluedroid): fixed an OOB bug in bta_av_setconfig_rej 2025-12-19 16:52:31 +08:00
Jin Cheng f7c0f92556 fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete 2025-12-19 16:52:31 +08:00
Jin Cheng 514bcb41a2 fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete 2025-12-19 16:52:31 +08:00
Jin Cheng 04219e5fd4 fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete 2025-12-19 16:52:31 +08:00
Jin Cheng 08a593d801 fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete 2025-12-19 16:52:31 +08:00
Jin Cheng a73e2e4d6c fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete 2025-12-19 16:52:31 +08:00
Jin Cheng 5a2b29fe82 fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute 2025-12-19 16:52:31 +08:00
Jin Cheng 3ec5f615ae fix(bt/bluedroid): report failure when not able to connect to AVRCP 2025-12-19 16:52:31 +08:00
Jin Cheng 56756b1b5d fix(bt/bluedroid): fixed buffer overflow in BRSF 2025-12-19 16:52:31 +08:00
Jin Cheng 11eea1b4de fix(bt/bluedroid): added negative length check in process_service_search_rsp 2025-12-19 16:52:31 +08:00
Jin Cheng be25062b0d fix(bt/bluedroid): fixed OOB read in SDP server continuation length 2025-12-19 16:52:31 +08:00
Jin Cheng 4df287c536 fix(bt/bluedroid): added length check when copy AVDTP packet 2025-12-19 16:52:31 +08:00
Jin Cheng 6a497ad921 fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET 2025-12-19 16:52:31 +08:00
Jin Cheng 019516284f fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item 2025-12-19 16:52:31 +08:00
Jin Cheng 158519cf8c fix(bt/bluedroid): added boundary check when reading SDP attribute response packet 2025-12-19 16:52:31 +08:00
Jin Cheng 173747750d fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp 2025-12-19 16:52:31 +08:00
Jin Cheng 4cb6ccc6f6 fix(bt/bluedroid): fixed potential OOB read in the reporting handler
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-19 16:52:31 +08:00
Jin Cheng f15fe75f24 fix(bt/bluedroid): fixed a potential overflow about the media payload offset
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-19 16:52:31 +08:00
Jin Cheng 15e0c748e5 fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2025-12-19 16:52:31 +08:00
Jin Cheng 70f82a5607 fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2025-12-19 16:52:31 +08:00
Jin Cheng 5b7c17cfc7 fix(bt/bluedroid): reject device with same address in legacy paring 2025-12-19 16:52:31 +08:00
Jin Cheng 0fc2109ec7 fix(bt/bluedroid): ignore AVCT commands that are too long 2025-12-19 16:52:31 +08:00
Jin Cheng 9095d1cd25 fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2025-12-19 16:52:31 +08:00
Jin Cheng 0f1c203e12 fix(bt/bluedroid): make sure SDP only start discovery once 2025-12-19 16:52:31 +08:00
Jin Cheng 1ba8aaaff8 fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2025-12-19 16:52:31 +08:00
Jin Cheng 33af3a0aa6 fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-19 16:52:31 +08:00
Jin Cheng e7e0be698a fix(bt/blurdoird): enable bitpool snity checks 2025-12-19 16:52:31 +08:00
Jin Cheng b70e8ae903 fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf 2025-12-16 11:38:55 +08:00
Jin Cheng 9889edd799 fix(bt/blurdoird): fixed an OOB write in bta_dm_sdp_result 2025-11-27 23:04:36 +08:00
Jin Cheng 051de7d578 fix(bt/controller): Fixed some controller bugs
- Fixed Bluetooth hardware error of 'CHMAP_ERROR'
- Fixed encryption collision bug
2025-11-13 19:46:56 +08:00
JinCheng 79ae28fbb7 fix(bt/bluedroid): update the COD before enabling inquiry scan 2025-11-11 16:17:30 +08:00
Jin Cheng b9ba1e29b6 fix(bt/bluedroid): fixed potential OOB in AVRCP vendor command composition 2025-10-28 10:17:04 +08:00
Jin Cheng 53a1c66d41 fix(bt/controller): fixed several controller bugs 2025-10-16 10:25:34 +08:00
Jin Cheng b4854cab63 fix(bt/controller): fixed the sniff anchor point can be mismatch from central and peripheral 2025-10-16 10:25:34 +08:00
JinCheng c3efac4608 fix(bluedroid): removed the code relying on compiler-specific extension for FAM in union 2025-09-27 11:31:05 +08:00
JinCheng 999710fccf fix(bt/bluedroid): fixed potential OOB in Bluedroid 2025-09-26 17:28:55 +08:00
JinCheng 86a9b4ff9e fix(bt/controller): fixed some controller bugs 2025-08-27 11:08:36 +08:00
JinCheng ccd0d369aa fix(esp_phy): update esp32 librtc.a for coex problems
- ESP32 phy_version: 4861, b71b5ad, Aug, 5 2025
- ESP32 librtc version: 6758f983, Mar 22 2024, 13:39:26
2025-08-08 23:14:47 +08:00
JinCheng f0f7ec705e fix(bt/bluedroid): safe string returns and cleanups for bt_discovery example 2025-07-31 21:08:24 +08:00
Jin Cheng b1ea7f7ae6 fix(bt/controller): update libbtdm_app.a
- fixed errors in the coexistance of ACL and SCO
- fixed dynamic priority config error in dual mode
2025-04-18 07:43:24 +08:00
Jin Cheng cd8fa5c46f fix(bt/bluedroid): fixed memory leaks in SPP callback mode 2025-02-26 19:12:47 +08:00
Jin Cheng 309747bf9a fix(bt/controller): fixed some controller bugs on ESP32.
1. added a VSC to control whether to initiate lmp_auto_rate
        - Closes https://github.com/espressif/esp-idf/issues/15133
    2. fixed EA resource cleanup error after SNIFF negotiation failure
        - Closes https://github.com/espressif/esp-idf/issues/13605
    3. removed an assertion in SCO data TX handler after disconnection
        - Closes https://github.com/espressif/esp-idf/issues/15176
2025-02-26 16:31:06 +08:00
Jin Cheng eb68ef4cc1 fix(bt/controller): fixed missing critical protections on linked-list structure of (e)SCO buffers 2025-01-07 18:56:23 +08:00
Jin Cheng 185b4d9d44 fix(bt/bluedroid): fixed access NULL in HFP callback handler 2024-12-05 13:19:18 +08:00
Jin Cheng 5e0a73bc56 fix(bt/controller): Fixed some bugs on esp32 controller
- Added VSC to update local Bluetooth clock
    - Added critical protection for the free method for sync buffers
    - Fixed zero attempt value set by role switch
2024-11-26 18:03:11 +08:00
Jin Cheng fdcf89ae6b feat(bt/bluedroid): added events to indicate the profile states of HFP 2024-11-22 17:14:16 +08:00
Jin Cheng 2b334d1dfa fix(bt/bluedroid): disconnect SDP connection on receiving incorrect response 2024-11-20 08:20:40 +08:00
Jin Cheng cfdefd3e03 fix(bt/controller): Fixed some controller bugs on ESP32
- Fixed wrong logic in handling sniff transaction collision at slave
      side
    - Fixed the issue ACL is stopped too early before eSCO
2024-11-08 12:53:56 +08:00
Jin Cheng c79eb0d5bf fix(bt/bluedroid): AG should send OK or other error codes to HF client
when it is driven by HF to initiate a call.
2024-11-08 12:51:00 +08:00
Jin Cheng e2241f1fc1 fix(bt/controller): Fixed some controller bugs on ESP32
- Fixed access NULL in SCO frame end
      Closes https://jira.espressif.com:8443/browse/IDFGH-10796
    - Added LAP checking for Periodic Inquiry
    - Removed an inproper assertion in SCO module
    - Fixed wrong logic in key exchange when
      LMP transaction collision occurred
    - Fixed the using of wrong error code in
      the transaction collision of role switch
2024-10-12 09:01:48 +08:00
Jin Cheng 9872a7bbd1 fix(bt/bluedroid): fixed AG and HF client cannot enter/exit sniff mode 2024-10-10 16:23:09 +08:00
Jin Cheng 6d85d86fe1 Revert "Disable sniff mode during (e)SCO connection."
This reverts commit 39a5eb84f3.
2024-10-10 16:10:11 +08:00
Jin Cheng 22fad3f0a8 fix(bt/controller): Fixed some controller bugs on ESP32
- Fixed access NULL in SCO frame end
      Closes https://jira.espressif.com:8443/browse/IDFGH-10796
    - Added LAP checking for Periodic Inquiry
    - Removed an inproper assertion in SCO module
    - Fixed wrong logic in key exchange when
      LMP transaction collision occurred
    - Fixed the using of wrong error code in
      the transaction collision of role switch
2024-09-23 15:33:11 +08:00
Jin Cheng 3964fb1fa8 fix(bt/controller): Removed an improper assertion in ACL link driver
- See more from jira BT-3591
2024-07-12 19:35:18 +08:00
Jin Cheng b79fcbb9d7 fix(bt/controller): Parse out the correct packet types from Host parameters
- For HCI command HCI_Enhanced_Setup_Synchronous_Connection
2024-04-30 17:38:58 +08:00
Jin Cheng 081dc80eb8 fix(bt/bluedroid): allocate memory for control block of HFP Audio Gateway in its initialization when dynamic memory is wnabled 2024-04-15 11:20:55 +08:00
Jin Cheng 98230244df fix(bt/controller): Use embedded assembly to get access to DPORT registers 2024-04-01 18:53:47 +08:00
Jin Cheng 82542d2e96 feat(bt/bluedroid): added a VSC to set minimal encryption key size 2024-03-25 10:50:06 +08:00
Jin Cheng 45af060963 change(bt/bluedroid): Use BTC util to convert HCI status to ESP status 2024-03-20 10:38:44 +08:00
Jin Cheng cdb2f2c570 fix(bt/controller): Fixed 3 esp32 bt controller bugs
update esp32 bt-lib (952debf4)

1. Increased the length of queue for coexist requestions
2. fix(bt/controller): Cleared BT SNIFF when no connections exists
3. fix(bt/controller): Corrected a typo in coex module
2024-02-29 11:02:37 +08:00
Jin Cheng f4f26e94bd feat(bt/bluedroid): Moved the memory allocation of HF AG control blocks to BTC module 2024-02-28 20:30:38 +08:00
Jin Cheng 20f2207d5f Merge branch 'bugfix/mem_leak_op_dev_name' into 'master'
fix(bt/bluedroid): Avoided possible memory leak in the module of BT device

See merge request espressif/esp-idf!29141
2024-02-28 15:54:24 +08:00
Jin Cheng a288640655 fix(bt/bluedroid): Avoided possible memory leak in the module of BT device 2024-02-23 14:14:50 +08:00
Jin Cheng 057eb7061d feat(bt/bluedroid): Added an event to notify the encryption mode to applicaiton layer 2024-01-05 09:40:38 +08:00
Jin Cheng 8582f9bedf fix(bt/bluedroid): corrected the strings of A2DP audio states 2024-01-04 17:52:11 +08:00
Jin Cheng 6ee9b95960 feat(bt/bluedroid): Added report for the type of link key in ESP_BT_GAP_AUTH_CMPL_EVT 2023-12-29 16:22:04 +08:00
Jin Cheng 42f19d657a docs(bt/bluedroid): update API documents of SPP 2023-12-26 09:13:20 +08:00
Jin Cheng a3f68aef8a feat(bt/bluedroid): Added API to get local device name 2023-12-15 19:30:12 +08:00
Jin Cheng e1a5122dbc Merge branch 'fix/build_error_in_compiler_performance_mode' into 'master'
fix(bt/bluedroid): fixed build error when compiler in performace mode

Closes IDFGH-11637

See merge request espressif/esp-idf!27816
2023-12-12 18:56:42 +08:00
Jin Cheng e78209ad47 fix(bt/bluedroid): Disabled Sniff Subrating temporarily as it did not work well 2023-12-05 20:10:03 +08:00
Jin Cheng 58256d8c4b fix(bt/bluedroid): Changed the default air mode to invalid value 2023-12-05 20:10:03 +08:00
Jin Cheng dba328d9d5 fix(bt/bluedroid): Removed redundant operation of SCO clean up 2023-12-05 20:10:03 +08:00
Jin Cheng 0f9e8687ee fix(bt/bluedroid): Corrected the definitions of HF Client callback events 2023-12-05 20:10:00 +08:00
Jin Cheng 48d410e10d fix(bt/bluedroid): Set the alarm_arg to NULL after releasing to avoid double free in l2cap 2023-11-30 19:47:57 +08:00
Jin Cheng 823e0711c9 fix(bt/bluedroid): Set the alarm_arg to NULL after releasing to avoid double free 2023-11-29 15:55:46 +08:00
Jin Cheng 57e3e97497 fix(bt/bluedroid): Avoided crash of LoadProhibited during HFP AG deinitialization
Move the release of the control blocks from the start
of deinitialization to the profile disabled event.
2023-11-17 09:39:46 +08:00
Jin Cheng eab9037b1c fix(bt/bluedroid): Added dynamic memory allocation for HFP control blocks 2023-11-16 20:10:29 +08:00
Jin Cheng f5c15be581 fix(bt/bluedroid): corrected the API documents of profile HFP and A2DP 2023-11-15 15:34:27 +08:00
Jin Cheng 4edd531fe3 fix(bt/bluedroid): Added some argument check in APIs of HFP AG 2023-11-15 15:18:22 +08:00
Jin Cheng 97e9eb5ca8 fix(bt/bluedroid): Fix the crash of invalid access to released resources
It is caused by the delayed timer is alarmed after esp_spp_deinit.
2023-11-15 02:12:14 +00:00
Jin Cheng 46327936cb feat(bt/bluedroid): Added an API to specify data types for ACL-U traffic 2023-11-02 17:43:04 +08:00
Jin Cheng 1f2a1564a2 feat(bt/bluedroid): Support to build HID Host and HID Device in single binary 2023-11-01 16:54:11 +08:00
Jin Cheng b319143e3b feat(bt/bluedroid): Added bt_discovery based host only example 2023-10-30 00:52:26 +00:00
Jin Cheng fc174f5811 feat(bt/bluedroid): Added mode to use BlueDroid host only without Bluetooth Controller 2023-10-30 00:52:26 +00:00
Jin Cheng d0e0928138 feat(bt/Bluedroid): Implemented esp_coex_status_set/clear using vendor HCI 2023-09-13 10:55:04 +08:00
Jin Cheng 3fb242660d fix(bt/controller): Fixed error in sniff negotiation
fix(bt/controller): Avoided both local and peer unsniff being triggered
fix(bt/controller): Fixed the crash of mixing of master- and slave-initiated sniff requests
fix(bt/controller): Moved the TX of HW_ERR_EVT out of interrupt context to thread context
fix(bt/controller): Fixed the issue rx_irq is generated after error_irq for slave sniff mode frame
fix(bt/controller): Fixed asser error resulted from failure of role switch frame insert
fix(bt/controller): Ignored rx_irq in inquiry scan frame end
fix(bt/controller): Ignored rx_irq in page scan frame end
fix(bt/controller): Added status check before set/clear sniff coex status
fix(bt/controller): Fixed IntegerDevideByZero caused by interrupted r_ld_sco_start
2023-09-12 12:20:50 +00:00
Jin Cheng 62f6af0dd7 fix(bt/bluedroid): Fixed incorrect arrangement in type esp_hf_dial_type_t 2023-09-12 06:53:11 +00:00
Jin Cheng 024862c76f change(bt/bluedroid): Added line information printing when error occurs CHECK_HF_IDX 2023-09-12 06:53:11 +00:00
Jin Cheng 9fed90bbb4 fix(bt/bluedroid): Fixed the issue of uninitialized parameters in event BTA_AG_WBS_EVT 2023-09-12 06:53:11 +00:00
Jin Cheng cde05ef495 fix(bt/bluedroid): Deleted the redundant 'memset' in btc_hf_cb_handler 2023-08-31 19:44:37 +08:00
Jin Cheng 0a03f7e03a docs(bt/bluedroid): Changed the description of esp_hf_client_reject_call 2023-08-30 17:27:13 +08:00
Jin Cheng 2668df265e fix(bt/bluedroid): Fixed invalid access to freed semaphore 2023-08-30 17:27:13 +08:00
Jin Cheng fbb69daaaa fix(bt/bluedroid): Fixed wrong indexes of HF-AG indicators 2023-08-30 17:27:13 +08:00