Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity
53,762 Commits 25 Branches 192 Tags
431983a0916423042e4d9c19669e3ddc19fb913f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
zhanghaipeng 0a93ccd3b3 fix(ble/bluedroid): Fixed potential double Execute Write Response 2026-06-26 15:36:43 +08:00
zhanghaipeng cc62c8bfb4 fix(bt): update ESP32 libbtdm_app.a to 4a0f94d5 
- Fix connection failure when using RPA with whitelist filtering
- Fix disconnect with reason 0x08 during full scan
- Fix peer RPA resolution failure when advertising with a local identity address
 2026-06-25 19:34:13 +08:00
zhanghaipeng 2ef10ef488 fix(ble/bluedroid): skip identity conversion for static random direct connect 
Do not rewrite static or non-resolvable random peer addresses to
identity type 0x03 when CONFIG_BT_BLE_RPA_SUPPORTED is enabled.
 2026-06-25 19:15:25 +08:00
zhanghaipeng 97905afccc fix(ble/bluedroid): cap Read By Type response length at ATT maximum 
Read By Type Response Length is one octet (max 255). When MTU was
large enough to return a long characteristic value in one pair, the
server wrote (UINT8)(value_len + 2) and overflowed (e.g. 513 -> 1),
so the client rejected the PDU as GATT_INVALID_PDU (0x04).

Cap server value to 253 bytes per pair, clamp the length byte, and
continue long reads via Read Blob when the capped size is returned.
 2026-06-25 10:49:39 +08:00
zhanghaipeng 29ae92f4ef fix(ble/bluedroid): unblock sync HCI cmd on Command Status error 
Release the BLE sync semaphore and record HCI status when a
synchronous command is rejected via Command Status, since no
Command Complete event follows.
 2026-06-24 15:32:50 +08:00
zhanghaipeng 13926bb9bc fix(ble/bluedroid): set REQ_WAITING before GATTC service-change rediscovery 
When service change cancels in-progress discovery, bta_gattc_disc_cmpl()
re-triggers discovery without marking auto_update as REQ_WAITING. If a
client command is queued in p_q_cmd, bta_gattc_start_discover() refuses
to restart and the command is never dispatched.
 2026-06-23 20:08:14 +08:00
zhanghaipeng f9eaeb5e84 fix(ble/bluedroid): report conn param update failure for unknown BD_ADDR 
Route unknown BD_ADDR and other immediate failures through the existing
need_cb path so ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT is always delivered.
 2026-06-22 14:08:16 +08:00
zhanghaipeng 1085a32be8 fix(ble/bluedroid): add context to GATTC reg-notify cache warning 
Include client_if, handle, bd_addr, and server cache state in the
warning logged when notification registration skips handle validation.
 2026-06-22 12:14:13 +08:00
zhanghaipeng 6c53838e66 fix(ble/bluedroid): return ESP_ERR_INVALID_ARG for invalid conn params 
Return ESP_ERR_INVALID_ARG instead of ESP_FAIL when connection
parameter validation fails
 2026-06-22 11:56:22 +08:00
zhanghaipeng 7d1c0e9a32 feat(ble/bluedroid): Optimize Bluedroid memory usage 
- Delete unused device records (~356B each)
 2026-06-22 11:17:27 +08:00
zhanghaipeng c339cec380 fix(ble/bluedroid): reject adv data on legacy directed ext adv 2026-06-17 17:50:29 +08:00
zhanghaipeng 47dd785a18 fix(ble/bluedroid): preserve HCI status on BLE 4.2 GAP failures 
Return BTM_HCI_ERROR | hci_status from legacy BLE 4.2 GAP HCI command
paths instead of mapping failures to BTM_ILLEGAL_VALUE or
BTM_NO_RESOURCES. Add btm_ble_status_from_hci() helper and propagate
real status through scan start/stop completion callbacks.
 2026-06-17 11:37:39 +08:00
zhanghaipeng 3a7896f2c5 refactor(bt): migrate bt_hci_to_btsnoop to esp-pylib 
Replace argparse with rich-click and use esp_pylib.logger for
standardized console output and fatal error handling.
 2026-06-16 14:43:06 +08:00
zhanghaipeng 7986e2faa8 feat(ble/bluedroid): Add BLE SMP support for multi-ADV with static random addresses 2026-06-15 14:41:51 +08:00
zhanghaipeng c18c8dc5e7 fix(bt): Suppress gattc drop-notif warning for unregistered gatt_if 
GATT stack broadcasts notifications to every client app, so unregistered
gatt_if instances were flooding logs even when another app had registered
the handle. Only warn when no client app registered for the handle.
 2026-06-08 15:34:58 +08:00
zhanghaipeng d5b9350d0f fix(ble/bluedroid): preserve ATT error on prepare write completion 
Skip prepare-write echo validation when the GATT stack reports a
non-success status. ATT Error Response carries no prepare-write echo
body (rsp_len=0), so the check incorrectly overwrote errors such as
GATT_INSUF_AUTHENTICATION (0x05) with GATT_INVALID_PDU (0x04).
 2026-06-04 16:25:29 +08:00
zhanghaipeng 4ab49f267b docs(bt): clarify BLE TX power priority and granularity 2026-06-01 11:20:27 +08:00
zhanghaipeng 43734e7d7b docs(bt): clarify GATT client auth_req may trigger SMP 2026-05-29 10:23:00 +08:00
zhanghaipeng 27fc241384 docs(bt/bluedroid): add usage note for esp_ble_get_cur_sendable_packets_num 2026-05-29 10:16:21 +08:00
zhanghaipeng 1a9f2af505 feat(ble/bluedroid): add auto-setting for is_aux parameter in esp_ble_gattc_enh_open 2026-05-29 10:16:21 +08:00
zhanghaipeng 4590b4bb34 doc(ble/bluedroid): clarify callback notes to avoid time-consuming ops 2026-05-29 10:16:20 +08:00
zhanghaipeng 82c5c1fef3 fix(ble/bluedroid): Ensure HIGH_DUTY_ADV_INTERVAL config is applied in stack 2026-05-29 10:16:20 +08:00
zhanghaipeng 7c1cb4b296 fix(bt): Add default BLE controller funcs reset enable 2026-05-29 10:08:18 +08:00
zhanghaipeng 4f8027da11 fix(ble/bluedroid): Propagate create_attr_tab BTA failures in inter_cb 2026-05-28 12:12:17 +08:00
zhanghaipeng fce3fa337a fix(ble/bluedroid): Validate signed-write perm vs AUTH in attr table check 2026-05-27 20:41:02 +08:00
zhanghaipeng 8da824cd0e fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(51d9dfde) 
- improve coded PHY performance under Wi-Fi coexistence
 2026-05-25 14:13:37 +08:00
zhanghaipeng 747c9adeaa fix(bt/bluedroid): validate handle in esp_ble_gattc_register_for_notify 2026-05-15 17:48:39 +08:00
zhanghaipeng 0af57d731c feat(ble): Support BLE critical logs 2026-05-13 14:22:40 +08:00
zhanghaipeng 519131a671 fix(bluedroid): correct format specifier in BLE create CIS debug log 2026-05-12 15:45:41 +08:00
zhanghaipeng 102a899d23 fix(ble): Optimize connection interval minimum parameter check 2026-04-30 10:55:30 +08:00
zhanghaipeng 658ff8730b fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(2f683593) 
- Fixed read remote feature timeout when using coded phy
- Fixed disconnection issue(0x08) when using 125k coded phy
- Fixed disconnection issue(0x08) when updating connection param
- Fixed disconnection issue(0x08) when using multi connection
- Avoid error when adding duplicate device to whitelist
- Support disable channel assessment by vendor hci
- Support smaller connection interval (3.75 ms)
- Support duplicate exception list in EVT ADV
 2026-04-28 18:26:22 +08:00
zhanghaipeng 74a053bd4e fix(bt/bluedroid): fix BLE SMP pairing failure on BLE-only devices when using default param 2026-04-01 12:10:16 +08:00
zhanghaipeng e3aac6f703 fix(ble): Fixed BLE assert in "emi.c" when low memory 2026-03-20 20:01:55 +08:00
zhanghaipeng 5a803144e8 fix(nimble): use pre-allocated buffer for HCI logging 2026-01-05 10:39:07 +08:00
zhanghaipeng 051077835c docs(ble): add flow diagrams to bluedroid BLE examples 2025-12-28 17:32:01 +08:00
zhanghaipeng 934970a06f feat(examples/bluedroid): add BLE ACL latency measurement example 2025-12-28 17:31:49 +08:00
zhanghaipeng fdeb5ad87a refactor(examples/bluedroid): Replace hardcoded ADV type values with macros 2025-12-28 16:40:37 +08:00
zhanghaipeng 8630040602 fix(bt/osi): add NULL check in osi_mutex_free and osi_sem_free (IDFGH-16853) 2025-12-28 11:19:39 +08:00
zhanghaipeng 6196298750 fix(bt/bluedroid): fix UAF in bta_gattc_enqueue for search service command 2025-12-28 11:19:39 +08:00
zhanghaipeng 7cd2f7b34d feat(examples/bluedroid): Add BLE time interval conversion macros for better readability 
Add macros to convert time values from milliseconds to BLE interval units:
- ESP_BLE_GAP_ADV_ITVL_MS: Convert advertising interval (0.625ms unit)
- ESP_BLE_GAP_SCAN_ITVL_MS: Convert scan interval (0.625ms unit)
- ESP_BLE_GAP_SCAN_WIN_MS: Convert scan window (0.625ms unit)
- ESP_BLE_GAP_CONN_ITVL_MS: Convert connection interval (1.25ms unit)
- ESP_BLE_GAP_PERIODIC_ADV_ITVL_MS: Convert periodic adv interval (1.25ms unit)
- ESP_BLE_GAP_SUPERVISION_TIMEOUT_MS: Convert supervision timeout (10ms unit)
 2025-12-28 11:19:39 +08:00
zhanghaipeng b6aed7e1c8 feat(ble/bluedroid): Increase maximum notify/indication registration count 2025-12-28 11:07:07 +08:00
zhanghaipeng 4ffd7b285b feat(ble/bluedroid): add periodic advertising create sync retry mechanism 2025-12-28 11:07:07 +08:00
zhanghaipeng 12225c457c fix(ble/bluedroid): Fix array index in set_periodic_adv_subevt_data 2025-12-28 11:07:07 +08:00
zhanghaipeng c5ebab70d8 fix(ble/bluedroid): Remove duplicate filter_policy in ext_conn_v2 HCI cmd 2025-12-28 11:07:07 +08:00
zhanghaipeng 6d49a99faa fix(ble/bluedroid): Fix heap buffer overflow in BTC_GAP_BLE_SET_PA_SUBEVT_DATA deep copy 2025-12-28 11:07:07 +08:00
zhanghaipeng 643d9c2387 fix(ble/bluedroid): Fix multiple out-of-bounds read vulnerabilities in GATT PDU handlers 2025-12-28 11:07:07 +08:00
zhanghaipeng 93cfbb8522 fix(ble/bluedroid): Fix out-of-bounds read in l2cble_process_sig_cmd 2025-12-28 11:07:07 +08:00
zhanghaipeng 597fc6e5c1 fix(ble/bluedroid): Fix integer underflow in gatt_process_read_by_type_rsp 2025-12-28 11:07:07 +08:00
zhanghaipeng da4793ce71 fix(ble/bluedroid): Improve robustness during host enable procedure 2025-12-23 10:24:00 +08:00
zhanghaipeng a721e94a0f fix(bt): fix BLE security issue in controller and HCI packet parser 2025-12-23 10:24:00 +08:00
zhanghaipeng c762832600 fix(ble/hci): Fix OOB read in ble_adv_scan_combined example 2025-12-23 10:24:00 +08:00
zhanghaipeng a36bf7fe14 fix(ble/bluedroid): Added security check in example Bluedroid_GATT_Server 2025-12-23 10:24:00 +08:00
Zhang Hai Peng 9a21040626 Merge branch 'bugfix/fix_ble_security_issue_2025_v2' into 'master' 
fix(ble/bluedroid): Enhanced security in ble_ancs example

Closes BHOST2025-59

See merge request espressif/esp-idf!43800
 2025-12-01 16:16:06 +08:00
zhanghaipeng f502b2aab1 fix(ble/bluedroid): Fix security issues in GATT module 2025-11-30 16:22:26 +08:00
zhanghaipeng b163685c06 fix(ble/bluedroid): Fix security issues in HCI module 2025-11-30 16:06:25 +08:00
zhanghaipeng 1ed5a4465d fix(ble/bluedroid): Fix security issues in GAP module 2025-11-30 15:48:24 +08:00
zhanghaipeng b03ff3cf21 fix(ble/bluedroid): Add length check in prepare write response 2025-11-30 15:00:26 +08:00
zhanghaipeng d2baf3b0d4 fix(ble/bluedroid): Add boundary check for adv_handle in btm_ble_adv_set_terminated_evt 2025-11-28 17:44:57 +08:00
zhanghaipeng e741f09e0f fix(ble/bluedroid): Fix VLA in a2dp_gatts_coex example 2025-11-27 20:00:55 +08:00
zhanghaipeng a6730c7da6 fix(ble/bluedroid): Add NULL checks in GATT APIs 2025-11-27 19:36:35 +08:00
zhanghaipeng b71c51564a fix(ble/bluedroid): Add NULL checks in esp_gap_ble_api 2025-11-27 19:28:21 +08:00
zhanghaipeng 4b44d8e814 fix(ble/bluedroid): Add NULL check in esp_ble_gap_add_device_to_resolving_list 2025-11-27 19:12:54 +08:00
zhanghaipeng 8e0f74a2cc fix(ble/bt): Add NULL check in esp_hid_device example 2025-11-27 18:05:33 +08:00
zhanghaipeng 8b5dd75368 fix(ble/bt): Add NULL check in esp_hid_host example 2025-11-27 18:05:20 +08:00
zhanghaipeng 773814c087 fix(ble/blufi): Add DH param length validation 2025-11-27 18:05:07 +08:00
zhanghaipeng b6b3b81bf6 fix(ble/bluedroid): Fix memory leak in ble_spp_server example 2025-11-27 18:04:54 +08:00
zhanghaipeng e26b60090d fix(ble/bluedroid): Use calloc in gatt_server example 2025-11-27 18:04:43 +08:00
zhanghaipeng 24e023e307 fix(ble/bluedroid): Use snprintf in ble_eddystone example 2025-11-27 18:04:32 +08:00
zhanghaipeng 7e876249df fix(ble/bluedroid): Add bounds check in ble_ancs example 2025-11-27 18:04:22 +08:00
zhanghaipeng 71efec78c5 fix(ble/bluedroid): Fix potential out-of-bounds issue 
- add length check in hci_hal_h4_hdl_rx_packet to prevent OOB
- add adv data length check in btm_ble_cache_adv_data
- add indicate data length check in BTA_GATTS_HandleValueIndication
- add report length check in bta_hh_parse_keybd_rpt
- add report length check in BTA_HdSendReport
- add descriptor length check in BTA_HdRegisterApp
- prevent buffer overflow in attribute processing
 2025-11-24 14:42:26 +08:00
zhanghaipeng e1d39f630f fix(ble/bluedroid): Fix potential CVE-2024-0039 out-of-bounds write in attp_build_value_cmd 
- Reference: https://source.android.com/docs/security/bulletin/2024-03-01?hl=zh-cn
 2025-11-24 14:42:26 +08:00
zhanghaipeng c5e50ccd19 fix(bt): Update esp32 libbtdm_app.a (15a18b1a) 
- fix(ble): fixed BLE enable scan timeout
 - fix(ble): fixed crash in "btdm_controller_task"
 2025-11-24 12:14:37 +08:00
zhanghaipeng 1f7fd91b5a fix(ble/bluedroid): Fix potential CVE-2020-0022 in reassemble_and_dispatch 
- Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-0022
 2025-11-24 11:59:12 +08:00
zhanghaipeng 60a028fb17 feat(ble/blufi): Support setting BLE encryption for blufi 2025-11-21 16:41:33 +08:00
zhanghaipeng 9bfd9c5340 fix(ble/bluedroid): Fixed BLE incorrect device record count issue 2025-11-18 11:25:22 +08:00
zhanghaipeng 2dcbd64616 fix(ble/bluedroid): Fixed missing BLE connect and disconnect events 2025-10-28 16:56:07 +08:00
zhanghaipeng 9df828835c fix(ble/bluedroid): fix memory leak during deinit when service table is created but not started 2025-10-17 17:45:35 +08:00
zhanghaipeng 3c68650d7e feat(ble/bluedroid): add API to get local BLE IRK 2025-10-17 17:36:45 +08:00
zhanghaipeng ca2c78f53e fix(ble/bluedroid): prevent crash when deinit/disable host during scan 
Crash occurs if the BLE host is deinitialized or disabled while scanning is still active.
This usage is not recommended.
 2025-10-13 13:27:04 +08:00
zhanghaipeng 7ce921ed95 fix(ble/bluedroid): Fixed resolve adv data crash if host deinitialized or disabled 2025-09-29 11:57:30 +08:00
zhanghaipeng 45775a3e35 feat(ble/bluedroid): Added BLE debug LOG for bluedroid 2025-09-26 20:10:32 +08:00
zhanghaipeng 1952f0333c docs(ble): add advisory for CVE-2025-55297 found in Blufi example 2025-08-25 14:04:39 +08:00
zhanghaipeng 3f4bedd3a5 feat(blufi): Update BluFi document 2025-08-15 14:18:05 +08:00
zhanghaipeng 12df54e8d1 fix(ble/bluedroid): Fixed potential out-of-bounds memory access when resolve adv data 2025-08-11 13:08:14 +08:00
zhanghaipeng 8ec5410236 fix(bt): Update esp32 libbtdm_app.a (f1dc7d8) 
- Improve ESP32 stability and security
 2025-08-07 21:19:06 +08:00
zhanghaipeng 155c32be20 fix(bt/ble): Update esp32 libbtdm_app.a (722c907a) 
- Fixed bt hci event was not report to host when hci command was sent
 2025-08-01 19:21:28 +08:00
zhanghaipeng 50fe55ca59 fix(ble/bluedroid): set sec_conn only on successful pairing in ble_hid_device_demo 2025-07-28 15:49:59 +08:00
zhanghaipeng b6dc79af47 fix(ble/bluedroid): Fixed fail to disconnect when device record is cleared 2025-07-25 10:30:11 +08:00
zhanghaipeng ac385530af fix(ble/bluedroid): fix incorrect resolving_list_avail_size update 2025-07-25 10:27:53 +08:00
zhanghaipeng 61606a6f95 fix(ble/bluedroid): ensure resolving list is updated when the oldest device is removed 2025-07-24 21:29:27 +08:00
zhanghaipeng 48235c7b25 fix(ble/bluedroid): Fix issue causing BTM_GetSecurityFlags failed 2025-07-08 17:12:30 +08:00
zhanghaipeng a663a87fe0 fix(bt/ble): Update esp32 libbtdm_app.a (3a27e2e) 
- Optimize check Access Address when receive connection request PDU
 2025-07-03 10:26:48 +08:00
zhanghaipeng a29cd4ad5f fix(ble/bluedroid): fix build failure when some BLE features are disabled 2025-06-24 20:26:43 +08:00
zhanghaipeng 49a4325b15 fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(4713a69) 
- Fixed double free exception during BLE init under low memory
 2025-06-05 11:10:25 +08:00
zhanghaipeng 8150573012 fix(ble/bluedroid): Fixed null pointer assert in l2c_link_check_send_pkts 2025-05-30 17:37:21 +08:00
zhanghaipeng 99121258d4 fix(ble/bluedroid): Fixed BLE SMP state machine inconsistency on disconnection 2025-05-29 10:50:50 +08:00
zhanghaipeng de9a367f13 feat(ble/bluedroid): Include SMP state in BLE status reporting 2025-05-29 10:36:26 +08:00
Zhang Hai Peng c91a897697 Merge branch 'bugfix/fix_send_delete_link_key_cmd_1' into 'master' 
Bugfix/fix send delete link key cmd 1

Closes BLERP-1735

See merge request espressif/esp-idf!39424
 2025-05-27 14:41:59 +08:00
zhanghaipeng 21391a45fd fix(ble/bluedroid): Fixed clear BLE device recored 2025-05-26 20:21:35 +08:00
zhanghaipeng 244d4f8fa7 fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(4713205) 
- Fix: Missing ADV reports after bonding and connection
 2025-05-16 11:55:52 +08:00