- Update LC3 in btc and bta, update AT
- Update LC3 in SCO frame transfer and examples
- improve lc3 transfer speed
- Fix some encoding and decoding bugs
- Rename the functions and macros to fit both msbc and lc3
- Add config dependency
- Add migration guides for bluetooth-classic
- change the statement of "Wide Band Speech" to "Wideband Speech" to fit HFPv1.10
- Add sdp_seq to avoid p_ccb being free during sdp
- Changed some BTA_Pba functions to return non-void value
- Improve error catching and report
- Refactor bta_pba_client_response to avoid UAF problem
- Rearrange btc_pba_client init flag to avoid some disturbing bug
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
related: obex, smp, pbap, sdp, rfcomm, stack_dm
- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Reject source audio send when A2DP is deiniting
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
HFP AG:
- Fix mSBC EV3 second-packet payload length calculation to prevent OOB read and infinite loop
- Add init/deinit guards in HF AG helper functions to avoid NULL deref
- Return bt_status_t from btc_hf_ag_audio_data_send to avoid silent buffer leak on SLC failure
- Break SCO CI data loop when SCO is not open to prevent CPU starvation
- Guard BTM_FreeSCN(0) and reset SCN after free in bta_ag_del_records
- Use OI_UINT32 for mSBC decode frame length to avoid stack corruption
- Bound AT Dial command string copy to BTA_AG_AT_MAX_LEN
HFP Client:
- Check osi_calloc result before use when reassembling split mSBC frames
- Use OI_UINT32 for mSBC decode frame length to avoid stack corruption
- Free SDP db, collision/AT timers and queued AT cmds before scb reset on disable
- Fix mSBC EV3 second-packet payload length calculation (same as AG)
- Reject pcm_resample input smaller than overlap window (96 bytes) on filtered path
- Break SCO CI data loop when SCO is not open to prevent CPU starvation
- Guard BTM_FreeSCN(0) and reset SCN after free in bta_hf_client_del_record
hejiaxin
yangfeng
zhanghaipeng
linruihao
Wang Meng Yang
Zhou Xiao
Island
zhiweijian
chenjianhua
Jin Cheng
Jiang Jiang Jian
Rahul Tank
Mayank Tyagi