Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity
53,370 Commits 25 Branches 192 Tags
6005d5bb6a57a2daf4a73be8a161e5cd3d3e2e85
Commit Graph

37106 Commits

Author SHA1 Message Date
Jiang Jiang Jian
6005d5bb6a Merge branch 'fix/lwip_sec_high_v6.1' into 'release/v6.1' 
fix(lwip): high severity lwip fixes (v6.1)

See merge request espressif/esp-idf!50590
 2026-07-16 11:35:55 +08:00
Jiang Jiang Jian
b3f2e9e67b Merge branch 'fix/uhci_rx_fsm_v6.1' into 'release/v6.1' 
fix(uhci): rx fsm race condition (v6.1)

See merge request espressif/esp-idf!50577
 2026-07-16 11:35:38 +08:00
Jiang Jiang Jian
64218b5dd3 Merge branch 'bugfix/smp_sec_flags_v6.1' into 'release/v6.1' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v6.1)

See merge request espressif/esp-idf!50565
 2026-07-16 11:35:17 +08:00
Jiang Jiang Jian
8346b7596e Merge branch 'feat/sec_esp_drivers_v6.1' into 'release/v6.1' 
fix(drivers): harden multiple peripheral drivers against local DoS and memory corruption (v6.1)

See merge request espressif/esp-idf!50555
 2026-07-16 11:33:01 +08:00
Jiang Jiang Jian
78519ced02 Merge branch 'feat/update_openthread_submodule_and_br_lib_20260624_v6.1' into 'release/v6.1' 
feat(openthread): update openthread submodule (v6.1)

See merge request espressif/esp-idf!50518
 2026-07-16 11:30:55 +08:00
Jiang Jiang Jian
5595996fe8 Merge branch 'feat/update_pmu_pau_reg_description_v6.1' into 'release/v6.1' 
feat(soc): update esp32c61 PMU & PAU reg header descriptions (v6.1)

See merge request espressif/esp-idf!50431
 2026-07-16 11:28:44 +08:00
Jiang Jiang Jian
66ed442256 Merge branch 'fix/fatfs_vulnerabilities_v6.1' into 'release/v6.1' 
fix(fatfs): harden against runZero 2026 FatFs bugs (v6.1)

See merge request espressif/esp-idf!50424
 2026-07-16 11:28:22 +08:00
Jiang Jiang Jian
f6eadf3e95 Merge branch 'fix/fix_mpll_enable_order_v6.1' into 'release/v6.1' 
fix(esp_hw_support): fix esp32s31 mpll initialization (v6.1)

See merge request espressif/esp-idf!50430
 2026-07-16 11:28:17 +08:00
Jiang Jiang Jian
0196213a13 Merge branch 'fix/ble_mesh_fixed_issues_v6.1' into 'release/v6.1' 
Resolve reported BLE mesh stack issues (6.1)

See merge request espressif/esp-idf!50408
 2026-07-16 11:27:36 +08:00
Jiang Jiang Jian
f174b3baa6 Merge branch 'fix/vfs_fatfs_test_stale_partition_v6.1' into 'release/v6.1' 
test(vfs): reformat WL FATFS in setup to avoid stale-partition flakes (v6.1)

See merge request espressif/esp-idf!50400
 2026-07-16 11:27:21 +08:00
Jiang Jiang Jian
0e479cbf81 Merge branch 'bugfix/i2c_set_but_not_used_variable_v6.1' into 'release/v6.1' 
fix(i2c): remove unused but set variables (v6.1)

See merge request espressif/esp-idf!50370
 2026-07-16 10:48:53 +08:00
Jiang Jiang Jian
e813155ec4 Merge branch 'feature/dma2d_ppa_sleep_retention_support_v6.1' into 'release/v6.1' 
feat(ppa): add sleep retention support for DMA2D and PPA (v6.1)

See merge request espressif/esp-idf!50342
 2026-07-16 10:48:27 +08:00
Jiang Jiang Jian
479ff2c98b Merge branch 'change/change_regdma_malloc_caps_v6.1' into 'release/v6.1' 
change(esp_hw_support): change regdma malloc caps to allow getting memory in the DMA pool (v6.1)

See merge request espressif/esp-idf!50257
 2026-07-16 10:44:21 +08:00
Jiang Jiang Jian
3e573b992b Merge branch 'fix/fix_async_color_convert_csc_v6.1' into 'release/v6.1' 
fix(dma2d): fix async color convert csc check (v6.1)

See merge request espressif/esp-idf!50238
 2026-07-16 10:43:55 +08:00
Jiang Jiang Jian
68137eca5d Merge branch 'fix/fix_ble_rtc_register_issue_after_reset_v6.1' into 'release/v6.1' 
fix(ble): fix ble rtc reset issues on esp32-h4 and esp32-s31 (6.1)

See merge request espressif/esp-idf!50204
 2026-07-16 10:43:26 +08:00
Jiang Jiang Jian
7a0db8d0aa Merge branch 'fix/ble_mesh_disable_adv_pkt_discard_log_v6.1' into 'release/v6.1' 
fix(ble_mesh): Disable warning logging when advertising packets are discarded (6.1)

See merge request espressif/esp-idf!50168
 2026-07-16 10:42:18 +08:00
Jiang Jiang Jian
590dab22f9 Merge branch 'fix/fix_rgb_frame_buffer_alignment_v6.1' into 'release/v6.1' 
fix(gdma): fix buffer alignment when psram ecc enabled (v6.1)

See merge request espressif/esp-idf!49996
 2026-07-16 10:40:18 +08:00
Jiang Jiang Jian
b259c51ee3 Merge branch 'change/update_c61_gdma_header_v6.1' into 'release/v6.1' 
change(ahb_dma): update c61 eco3 header files (v6.1)

See merge request espressif/esp-idf!49835
 2026-07-16 10:38:55 +08:00
morris
a28640f417 fix(i2c): remove unused but set variables 2026-07-13 14:40:45 +08:00
Ashish Sharma
8d8068aee3 fix(esp_tee): fix DS-lock leak, intr-matrix OOB, calloc overflow, attestation leak 2026-07-13 14:40:44 +08:00
Ashish Sharma
2a63a05a85 fix(esp-tls): reject NULL host/url in plain-TCP and async HTTP connect 2026-07-13 14:40:44 +08:00
Ashish Sharma
e4304fab76 fix(mbedtls): validate crypto input lengths (TEE OOB, auth-bypass, overflows) 2026-07-13 14:40:44 +08:00
Ashish Sharma
e382f878cc fix(esp_https_server): free TLS session on transport_ctx OOM in httpd_ssl_open 2026-07-13 14:40:44 +08:00
Ashish Sharma
35227e41e9 fix(esp_hal_security): clamp tag_len in aes_hal_gcm_read_tag to prevent OOB 2026-07-13 14:40:44 +08:00
Ashish Sharma
bcfb0407f9 fix(bootloader_support): guard NULL efuse digest slot in secure-boot verify 2026-07-13 14:40:44 +08:00
Ashish Sharma
ef4ecd0591 fix(esp_http_client): fix digest-auth leaks and credential/handle use-after-free 2026-07-13 14:40:44 +08:00
Ashish Sharma
b589180b8b fix(esp_http_server): close UAF/double-free, buffer underflows, and OOB read 2026-07-13 14:40:44 +08:00
Ashish Sharma
9843bcc8dc fix(app_update): close OOB read, rollback-guard gap, and length underflow 2026-07-13 14:40:44 +08:00
morris
0f3a788f16 fix(sdspi): reject oversized pre-read data before block receive 
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
 2026-07-13 11:18:12 +08:00
morris
f1cc319c2d fix(spi_slave): free DMA-private buffers when transaction queue is full 
spi_slave_queue_trans calls spi_slave_setup_priv_trans to allocate
DMA buffers, then tries xQueueSend. If the queue is full the function
returns ESP_ERR_TIMEOUT without freeing those buffers, leaking up to
2 * max_transfer_sz per failed call. Call spi_slave_uninstall_priv_trans
before returning the timeout.
 2026-07-13 11:18:12 +08:00
morris
2ab4b39ce5 fix(jpeg): release platform mutex on semaphore/pm-lock allocation failure 
jpeg_acquire_codec_handle acquires s_jpeg_platform.mutex at entry
but two ESP_RETURN_ON_* macros (semaphore-create and PM-lock-create
failure) return without releasing it. Replace with ESP_GOTO_ON_*
that jumps to a cleanup label which frees partial resources, NULLs
the codec pointer, and releases the mutex.
 2026-07-13 11:18:12 +08:00
morris
cd28383088 fix(i2c): release platform mutex on intr/pm_lock delete failure 
ESP_RETURN_ON_ERROR inside the s_i2c_platform.mutex critical section
returns without releasing the mutex, permanently blocking all I2C
bus operations. Replace with ESP_GOTO_ON_ERROR that jumps to a
cleanup label releasing the mutex before return.
 2026-07-13 11:16:54 +08:00
morris
2c2f5ebf20 fix(csi): move csi_fsm init before resource allocation to fix err-path leak 
CSI_FSM_INIT is 1, but the controller struct is zero-allocated.
Any failure before the former csi_fsm assignment (near the end of
esp_cam_new_csi_ctlr) jumped to err: which called s_del_csi_ctlr.
That function bailed out immediately because csi_fsm == 0, leaking
the claimed slot, queue, bridge, DMA channel, PM lock, and backup
buffer. Move csi_fsm = CSI_FSM_INIT right after a successful claim
so the err: path properly tears down all allocated resources.
 2026-07-13 11:16:54 +08:00
morris
403074177f fix(adc): add missing input validation for channel and ret_handle 
- adc_cali_curve_fitting: validate config->chan in check_valid() to
  prevent OOB access into s_adc_cali_chan_compens compensation table
- adc_filter: make s_adc_filter_free idempotent on !UNIT_BINDED SoCs
  to prevent double-free on repeated adc_del_continuous_iir_filter
- adc_cali_line_fitting(esp32): fix config && config typo to
  config && ret_handle, preventing NULL-pointer dereference
 2026-07-13 11:16:54 +08:00
wuzhenghui
b388afd2f3 fix(esp_hw_support): update memory pointer checks for SPM support 2026-07-10 14:19:47 +08:00
Laukik Hase
87a5664883 ci(esp_tee): Fix tee_cli_app build failure due to heap size overflow 
- Also fix the `unused variable` warning while builing the PSA
  AES tests with `tee_test_fw` app
 2026-07-10 10:30:02 +05:30
Mahavir Jain
33217d154f Merge branch 'fix/esp_http_client_header_buffer_too_small_v6.1' into 'release/v6.1' 
feat(esp_http_client): detect oversized headers in tx buffer at send site (v6.1)

See merge request espressif/esp-idf!50313
 2026-07-10 09:41:40 +05:30
Mahavir Jain
5288101bdc Merge branch 'fix/harden_esp_security_v6.1' into 'release/v6.1' 
fix(esp_security): harden crypto peripheral error handling (v6.1)

See merge request espressif/esp-idf!50324
 2026-07-10 09:39:59 +05:30
Mahavir Jain
f0fbd9d9fa Merge branch 'fix/tls1_3_dynamic_buffer_server_crash_v6.1' into 'release/v6.1' 
fix(mbedtls): fixes TLS1.3 server failing with dynamic buffer (v6.1)

See merge request espressif/esp-idf!50386
 2026-07-10 09:38:26 +05:30
David Cermak
0eafcb83e0 fix(lwip): tcp/ooseq: do not accept empty fin seg (+ other fixes) 
* Update submodule: git log --oneline 9d2d8041..c6f2f878
  - test(lwip): add DHCP MTU validation unit test (espressif/esp-lwip@c6f2f878)
  - ppp: fix potential oob read in VJ decompression (espressif/esp-lwip@2ff439e6)
  - ip6-frag: Fix incorrect memcpy size to the actual struct (espressif/esp-lwip@91ad363b)
  - tcp/ooseq: do not accept empty fin seg (espressif/esp-lwip@fe4fb18c)
 2026-07-09 16:04:37 +02:00
David Cermak
880b4cc2e9 fix(lwip): Adds nullchecks after DHCP server alloc'd pools 2026-07-09 16:04:37 +02:00
David Cermak
d45d04dc43 fix(lwip): reject invalid DHCP MTU option values 
Validate MTU from DHCP option 26 against RFC 2132 minimum (68 bytes)
before applying to netif->mtu, preventing rogue DHCP servers from
setting MTU to 0 or other dangerously low values that cause integer
wraparound in IPv4 fragmentation.
 2026-07-09 16:04:37 +02:00
Hu Rui
c73094392f fix(uhci): rx fsm race condition 
Closes https://github.com/espressif/esp-idf/issues/18746
 2026-07-09 18:55:12 +08:00
wuzhenghui
38421b8db7 change(heap): reserve DMA pool with low priority MALLOC_CAP_DEFAULT caps 2026-07-09 17:30:46 +08:00
Jin Cheng
e4c999e891 fix(bt/bluedroid): fixed OOB read in PBAP app parameter parsing 
Closes SEC-713
 2026-07-09 15:44:57 +08:00
Jin Cheng
b6a8e896e7 fix(bt/bluedroid): fixed stuck sec_state on authention HCI command send failure 
Closes SEC-1164
 2026-07-09 15:44:57 +08:00
Jin Cheng
02841cdf50 fix(bt/bluedroid): fixed HID host slot leak on local VUP ACL drop 
Closes SEC-1169
 2026-07-09 15:44:57 +08:00
Jin Cheng
81c8d1b999 fix(bt/bluedroid): fixed NULL dereference in remote legacy authentication handler 
Closes SEC-1143
 2026-07-09 15:44:57 +08:00
Jin Cheng
91d80bf874 fix(bt/bluedroid): fixed integer overflow in HID report descriptor parser 
Closes SEC-084
 2026-07-09 15:44:57 +08:00
Jin Cheng
a0ba14e55d fix(bt/bluedroid): fixed wrong link key flag cleared on legacy BR/EDR authentication failure 
Stale bond trust state cound remain after authenticaion failure, causing
incorrect bond status and link key auto-reply behavior.

Closes SEC-1153
 2026-07-09 15:44:57 +08:00