Use a temporary pointer for br_glue port-list realloc so a failure does
not clobber the existing array. Reject NULL mac in esp_netif_set_mac and
validate config->base in esp_netif_new_api before use.
Co-authored-by: Cursor <cursoragent@cursor.com>
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
(cherry picked from commit ed1f4de3a3)
Co-authored-by: luoxu <luoxu@espressif.com>
The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
related: obex, smp, pbap, sdp, rfcomm, stack_dm
- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
Reset the LP SPI peripheral and GPIOs before and after every SPI case so
each test starts from a known-clean baseline, and gate the master on an
explicit slave-armed handshake so the master cannot clock the bus while
the slave is still in its arm prologue. Verify received data against the
expected pattern with bounded waits instead of merely logging it.
Add a dedicated LP SPI multi-device pytest for esp32p4 that runs the
retagged lp_core_spi cases, and tag the LP I2C case accordingly.
The LP SPI driver read and wrote the W0..W15 data buffer registers a
whole 32-bit word at a time, which overran the caller's buffer for
transfers whose length was not a multiple of four bytes and corrupted
the received data. Read and write the data buffer byte-granularly so
sub-word transfers no longer alias adjacent bytes.
The master transfer also programmed the shared bit-length register from
tx_length alone, truncating receive-longer-than-transmit transactions,
and always enabled MOSI even on read-only transfers, clocking out stale
buffer contents. Size each hardware transaction by max(tx_length,
rx_length) and gate MOSI/MISO on the corresponding buffer.
The slave path reused the master's single-shot flow, so it re-triggered
reg_update after preload (clocking out the previous transaction's data)
and offered no way for the caller to publish readiness before the master
started the clock. Split the slave transfer into an arm step that
preloads the buffer and starts the user phase, and a wait step that
blocks on TRANS_DONE and drains only the bytes the master actually
clocked in, tracked in software since reg_usr is not a reliable busy
indicator in slave mode.
Set the LP IO direction for the SPI pads, add
lp_core_lp_spi_bus_deinit() to release the LP GPIO pins, and reset the
LP SPI peripheral at bus initialization so a stale configuration from a
previous run cannot leak into the next.
