Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-29 17:54:23 +03:00
Code Issues Packages Projects Releases Wiki Activity
48,949 Commits 25 Branches 192 Tags
39e7e142f7da080ee77cb97fc6358e4e6dbd5fc3
Commit Graph
688 Commits
Author SHA1 Message Date
yangfeng 39e7e142f7 fix(bluedroid): Fix the compilation issue of BCM_STRNCPY_S 2026-08-24 16:53:18 +08:00
yangfeng c1a1c97189 fix(bt): Fix the critical issues related to A2DP from AI review report 
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Reject source audio send when A2DP is deiniting
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
 2026-08-18 11:26:53 +08:00
liqigan e9ab88137c change(bt/bluedroid): Refactored HCI ACL datapath 2026-08-13 07:49:29 +08:00
Jiang Jiang Jian c8713ab22c Merge branch 'feat/support_pawr_connect_evt_v5.5' into 'release/v5.5' 
feat(ble/bluedroid): Support PAWR connection event (5.5)

See merge request espressif/esp-idf!51441
 2026-08-06 11:25:19 +08:00
hejiaxin 49f12e853e feat(bluedroid): Add config to place btu and hci task stack in psram 
- Also adjust the osi_thread_stop implementation.
 2026-08-04 14:55:59 +08:00
Wang Meng Yang 89a63e35b8 Merge branch 'fix/aireview_critical_v5.5' into 'release/v5.5' 
fix: Fix some critical bugs in classic bt (v5.5)

See merge request espressif/esp-idf!51290
 2026-08-04 14:16:54 +08:00
Zhi Wei Jian 49cddfd411 feat(ble/bluedroid): Support PAWR connection event 
(cherry picked from commit 7da7fa42ac)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-08-03 15:25:53 +08:00
Jin Cheng 6e4bd4152d fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-07-29 17:30:25 +08:00
hejiaxin 60289a9c60 fix(bt): Fix some bug in stm_sco.c 
- Memory safety
- State machine & logic integrity
- Resource leaks
- Edge cases check
 2026-07-29 17:30:25 +08:00
hejiaxin 18c6d51e46 fix(bt_stack): Fix some critical bugs in classic_bt stack 
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
 2026-07-29 17:05:35 +08:00
Island 5f29e3e2e1 Merge branch 'fix/ble_hidd_remove_ccc_gating_v5.5' into 'release/v5.5' 
fix(esp_hid/bluedroid): remove app-layer CCC gating in HID device (5.5)

See merge request espressif/esp-idf!51006
 2026-07-23 19:26:08 +08:00
Wang Meng Yang 7bf2026549 Merge branch 'bugfix/bredr_critical_bugs_v5.5' into 'release/v5.5' 
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v5.5)

See merge request espressif/esp-idf!51079
 2026-07-23 16:45:34 +08:00
Jin Cheng b7ccc6e9ed fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:50:26 +08:00
Zhang Hai Peng fb7e051f97 fix(ble/bluedroid): track ext scan state for rand addr check 
Update inq_var.state only after btsnd_hcic_ble_ext_scan_enable succeeds.
Clear BTM_BLE_SCANNING on explicit stop and controller scan timeout.


(cherry picked from commit 23519567e4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-07-21 10:53:25 +08:00
Zhi Wei Jian 7ab919a76e feat(ble/bluedroid): Support bluedroid dual identity 
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:32:11 +08:00
Zhi Wei Jian 11a1a33e26 fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders 
(cherry picked from commit abbf001120)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:28:30 +08:00
Zhi Wei Jian f4650eb7c0 fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure 
(cherry picked from commit 4fd1ebb4a9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:28:23 +08:00
Zhi Wei Jian e97d59c545 docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked 
(cherry picked from commit 34b59d30ae)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:28:15 +08:00
Zhi Wei Jian 932da59cb4 fix(ble/bluedroid): fix direct-connect cleanup and adv bounds 
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:28:07 +08:00
Zhi Wei Jian f006758550 fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device 
(cherry picked from commit 93ab11d564)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:28:00 +08:00
Zhi Wei Jian 0314335eb6 fix(ble/bluedroid): validate SMP pair-fail reason and OOB device 
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:27:52 +08:00
Zhi Wei Jian 91b305b663 fix(ble/bluedroid): route ATT indication-conf timeout separately 
(cherry picked from commit 6c3267ee84)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:27:44 +08:00
Zhi Wei Jian 111c68776d fix(ble/bluedroid): validate ATT PDU sizes 
(cherry picked from commit bb00b9817d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:27:33 +08:00
Zhi Wei Jian 8eb01128f8 fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback 
(cherry picked from commit 37562af0ea)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:27:25 +08:00
Zhi Wei Jian 30a8c37942 fix(ble/bluedroid): fix GATT long read and Service Changed CCC 
(cherry picked from commit 4ce692ac0c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:27:17 +08:00
Zhi Wei Jian e35311d351 fix(ble/bluedroid): validate GATT client discovery handles 
(cherry picked from commit ac35ae6f2d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:27:05 +08:00
Zhi Wei Jian 7c850b6031 fix(ble/bluedroid): cap Read By Type length and free failed service decl 
(cherry picked from commit 27ff0cf8c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:26:56 +08:00
Zhi Wei Jian ff3f650a10 fix(ble/bluedroid): guard GATT database hash and serialization 
(cherry picked from commit 995c1508e8)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:26:44 +08:00
Zhi Wei Jian 6db42b6334 fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling 
(cherry picked from commit f86739b03d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:26:35 +08:00
Zhi Wei Jian 4779dec633 fix(ble/bluedroid): fix GATT teardown and service-change flow 
(cherry picked from commit 0645ba469d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:26:27 +08:00
Zhi Wei Jian b1b015187f fix(ble/bluedroid): fix GATT service lifecycle leaks 
(cherry picked from commit ac93d94958)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:26:19 +08:00
Zhi Wei Jian 0eccb599fe fix(ble/bluedroid): add GATT resource-cleanup helpers 
(cherry picked from commit b83327f3ca)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:26:11 +08:00
Zhi Wei Jian c055e45c8f feat(ble/bluedroid): Support bluedroid LE COC and EATT features 
(cherry picked from commit 83f0831c53)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-21 10:25:58 +08:00
Island 0196f65f01 Merge branch 'bugfix/fix_bluedroid_static_random_conn_rpa_v5.5' into 'release/v5.5' 
fix(ble/bluedroid): skip identity conversion for static random direct connect (5.5)

See merge request espressif/esp-idf!50084
 2026-07-20 21:39:24 +08:00
Island 12ac2416be Merge branch 'feat/add_ble_core_6x_feature_for_bluedroid_v5.5' into 'release/v5.5' 
Feat/add ble core 6x feature for bluedroid (5.5)

See merge request espressif/esp-idf!50052
 2026-07-20 15:05:36 +08:00
Wang Meng Yang ee9e08ddd9 Merge branch 'bugfix/bug_bounty_av_v5.5' into 'release/v5.5' 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v5.5)

See merge request espressif/esp-idf!50478
 2026-07-20 14:56:39 +08:00
Wang Meng Yang 839df7e697 Merge branch 'bugfix/avrc_ca_attr_id_check_v5.5' into 'release/v5.5' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v5.5)

See merge request espressif/esp-idf!50551
 2026-07-20 14:56:06 +08:00
Wang Meng Yang 31e6b62389 Merge branch 'bugfix/ai_review_avrcp_v5.5' into 'release/v5.5' 
fix(bt): Fix the critical and high issues related to AVRCP from AI review report (v5.5)

See merge request espressif/esp-idf!50021
 2026-07-20 09:06:53 +08:00
Wang Meng Yang eae640068e Merge branch 'bugfix/ai_review_btu_common_v5.5' into 'release/v5.5' 
fix: Fix the critical issues of btu and bt_common from AI review report (v5.5)

See merge request espressif/esp-idf!50123
 2026-07-20 09:05:33 +08:00
Wang Meng Yang 071970e478 Merge branch 'bugfix/smp_sec_flags_v5.5' into 'release/v5.5' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v5.5)

See merge request espressif/esp-idf!50567
 2026-07-19 13:16:19 +08:00
Wang Meng Yang df95e83bfa Merge branch 'bugfix/bbp_issues_v5.5' into 'release/v5.5' 
Bugfix/bbp issues v5.5

See merge request espressif/esp-idf!50190
 2026-07-19 12:46:06 +08:00
yangfeng b7d0ef96a7 fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC 
Closes SEC-1186
 2026-07-19 10:10:59 +08:00
yangfeng 31d51adf4f fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq 
Closes SEC-1187
 2026-07-19 10:10:59 +08:00
yangfeng b195d90679 fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-19 10:08:59 +08:00
linruihao 817d132ed0 fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:24 +08:00
zhanghaipeng 7f60576477 fix(ble/bluedroid): match read-multiple responses by handle 
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.
 2026-07-15 15:48:46 +08:00
zhanghaipeng e76bd7359c fix(ble/bluedroid): match read-multiple-var responses by handle 2026-07-15 15:48:46 +08:00
zhanghaipeng 11bdcf8294 fix(ble/bluedroid): use sr_cmd status for GATT server error rsp 
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.
 2026-07-15 15:48:46 +08:00
zhanghaipeng 0e6508a8fc fix(ble/bluedroid): reject invalid ATT error code 0x00 on client 
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.
 2026-07-15 15:48:46 +08:00
zhanghaipeng f6f289689a fix(ble/bluedroid): preserve ext adv state when set params fails 
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.
 2026-07-15 15:48:46 +08:00