Sort bond entries by bond_count after in-place updates to maintain correct
eviction order, and log IRK resolving-list failures instead of failing the bond.
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Reject source audio send when A2DP is deiniting
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
- Add sdp_seq to avoid p_ccb being free during sdp
- Changed some BTA_Pba functions to return non-void value
- Improve error catching and report
- Refactor bta_pba_client_response to avoid UAF problem
- Rearrange btc_pba_client init flag to avoid some disturbing bug
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
(cherry picked from commit ed1f4de3a3)
Co-authored-by: luoxu <luoxu@espressif.com>
related: obex, smp, pbap, sdp, rfcomm, stack_dm
- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
The BLE log compression feature (CONFIG_BT_LOG_CRITICAL_ONLY ->
BLE_COMPRESSED_LOG_ENABLE) failed to build on Windows while working
correctly on Linux, due to two shell/platform-specific issues in the
compression script.
1. Module/source argument quoting. CMakeLists.txt passes the
semicolon-separated module and source lists wrapped in single quotes
("'${MODULES}'") to protect ';' from POSIX shells, which strip them.
cmd.exe does not treat single quotes as quoting characters, so on
Windows the quotes reached the script literally and
args.module.split(';') produced "'BLE_MESH" / "BLE_HOST'" instead of
the clean names. These never matched the YAML module keys, every
module was skipped ("Skipping module ... - config not found"), the
compressed sources were never generated, and the build failed. Strip
surrounding quote characters before splitting; this is a no-op on
Linux/macOS where the shell already removed them.
2. CRLF line endings. With core.autocrlf=true the IDF sources are
checked out as CRLF on Windows. The generated *_log_index.h macros
use backslash-newline line-continuation; a backslash followed by
'\r\n' is not a valid continuation in C, producing floods of syntax
errors when the header is compiled. Write generated headers with
newline='' to force LF, and normalize source content to LF right
after reading so '\r' embedded inside multi-line argument expressions
is also handled. Byte offsets stay consistent because both tree-sitter
parsing and tag replacement operate on the normalized content.
Verified by full clean builds of examples/bluetooth/esp_ble_mesh/
vendor_models/vendor_client (esp32c6, bluedroid + mesh) from both
cmd.exe and PowerShell; both produce an identical vendor_client.bin.
(cherry picked from commit aa9b565a6d)
Co-authored-by: luoxu <luoxu@espressif.com>
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
yangfeng
Rahul Tank
Wang Meng Yang
hejiaxin
liqigan
Jiang Jiang Jian
Island
Luo Xu
Zhi Wei Jian
cjin
Jin Cheng
chenjianhua
Fu Hanxi
Shreeyash Bhakare
Astha Verma