Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
53,087 Commits 25 Branches 192 Tags
84beb7abcd6d9d50dc00aeecc571262d58edb82c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jin Cheng e44fcbd35f fix(bt/controller): fixed several BR/EDR controller bugs found by WVT regression tests on ESP32 2026-06-29 10:38:34 +08:00
Jin Cheng 3be52f9d46 fix(bt/bluedroid): added buffer length check for OBEX APIs 2026-06-17 07:23:59 +08:00
Jin Cheng 10eb7df430 fix(bt/bluedroid): added buffer length check for HID Device data indication 2026-06-17 07:23:59 +08:00
Jin Cheng ad84fe5f87 fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received 2026-06-17 07:23:59 +08:00
Jin Cheng 964dec2081 fix(bt/bluedroid): fixed CTKD link key authentication downgrade in SC-Only mode 2026-06-17 07:23:59 +08:00
Jin Cheng ed980ec113 fix(bt/bluedroid): added buffer length check for HID host data indication 2026-06-17 07:23:59 +08:00
Jin Cheng 14c99559b4 fix(bt/bluedroid): added buffer length check for L2CAP related functions 2026-06-17 07:23:59 +08:00
Jin Cheng ad5748f1af fix(bt/controller): fixed several BR/EDR controller bugs found by WVT regression tests on ESP32-S31 2026-06-12 15:39:17 +08:00
Jin Cheng b62e578edd fix(bt/controller): fixed several BR/EDR controller bugs found by WVT regression tests on ESP32-S31 2026-06-09 16:34:36 +08:00
Jin Cheng 5d0b77797b fix(bt/bluedroid): fixed SDP deinit race with pending callbacks 
Cancel any active SDP search during disabling and mark the BTA SDP
callbacks inactive so late search completions are not propagated
after deinit. Guard BTC side SDP completion handling after cleanup
to avoid null references.
 2026-05-21 20:33:35 +08:00
Jin Cheng 2ea0396135 fix(bt/controller): fixed several controller issues 
- added support for PCM over I2S
- ignored bandwidth and retransmission effort during SCO negotiation
- fixed use-after-free issues while handle the saved PDU
- removed unreasonable check for the packet write-back value
- fixed SSP unhandle LMP_NOT_ACCEPTED
- removed incorrect clearing of ACL flags
- fixed incorrect strategy to narrow down allowed packet types during
  eSCO negotiation
 2026-05-21 15:12:14 +08:00
Jin Cheng 4905a0aeb2 feat(ci): added example tests for HFP using external codec 2026-05-14 12:10:47 +08:00
Jin Cheng bd8078ca04 fix(bt/bluedroid): fixed building errors in HFP datapath 2026-05-14 10:35:25 +08:00
Jin Cheng 4f233e304c fix(bt/bluedroid): fixed the vulerabilities from AI code review in HID 2026-05-06 18:29:08 +08:00
Jin Cheng af9ec3cd58 fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid 2026-05-06 18:05:14 +08:00
Jin Cheng 83ede08702 fix(bt/controller): fixed sevaral controller issues 
- Relax the TID checks during EPR to be compatible with some RealTek devices
        - Closes https://github.com/espressif/esp-idf/issues/18145
    - Fixed wrong HCI event used for eSCO connection update
    - Do not inform the host when conneciton request was automatically rejected
 2026-04-16 20:27:47 +08:00
Jin Cheng 8999e14df8 fix(bt/bluedroid): moved L2CAP length check into start packets only 2026-04-08 20:13:37 +08:00
Jin Cheng c9a11c1ff9 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in SBC 2026-04-01 09:42:51 +08:00
Jin Cheng ed270d71c8 fix(bt/bluedroid): fixed the vulerabilities from AI code review in SPP 2026-03-30 17:38:46 +08:00
Jin Cheng 6702e66dd8 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in Bluedroid 2026-03-27 11:28:37 +08:00
Jin Cheng 42f3ed145d fix(bt/bluedroid): flushed all the DM PM at the end of SPP deinit 2026-03-27 11:20:54 +08:00
Jin Cheng dba6432d81 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in SPP 2026-03-23 11:22:06 +08:00
Jin Cheng 6b7909f20e fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in HID 2026-03-23 09:48:10 +08:00
Jin Cheng 34143d48ee fix(bt/bluedroid): fixed possible use of uninitialized stack variables in bt_hf_client_at.c 2026-03-16 12:09:06 +08:00
Jin Cheng 60f9362f83 fix(bt/bluedroid): fixed possible OOB read in avrc_pars_vendor_cmd 2026-03-10 08:43:56 +08:00
Jin Cheng 588b03d0d8 fix(bt/controller): fixed remote LMP_AU_RAND is mistakely rejected 2026-02-25 11:05:39 +08:00
Jin Cheng f694fc15ce fix(bt): fixed semaphore deletion condition in UART DMA deinit 2026-01-15 10:04:22 +08:00
Jin Cheng bdec9fe83a fix(bt): enhanced packet length check in sdp_server.c 2026-01-15 10:04:22 +08:00
Jin Cheng b18f09fc54 fix(bt): enhanced packet length check for avrc_pars_vendor_cmd 2026-01-15 10:04:22 +08:00
Jin Cheng 2566cc6609 fix(bt): enhanced packet length check for HCI module 2026-01-15 10:04:22 +08:00
Jin Cheng 36b9f5270a fix(bt): validated UUID parameters in BTA_JvStartDiscovery 2026-01-15 10:04:22 +08:00
Jin Cheng 0717ae3acf fix(bt/bluedroid): A2DP source at acceptor side will miss ESP_A2D_AUDIO_CFG_EVT 2026-01-13 10:14:43 +08:00
Jin Cheng 4adb4b9010 fix(bt/bluedroid): add status management for audio sink service channel 2026-01-12 19:16:33 +08:00
Jin Cheng 44b05258d7 fix(bt/controller): fixed wrong key type during changing connection link key 2026-01-05 17:34:26 +08:00
Jin Cheng c1fdcddac4 docs: update vulnerabilities guide to mention CVE-2025-68473 and CVE-2025-68474 2025-12-25 13:40:14 +08:00
Jin Cheng 4a49312321 fix(bt/bluedroid): cleaned the code according to the tool cppcheck 2025-12-16 17:37:14 +08:00
Jin Cheng 1c0c9c6fbd fix(bt/bluedroid): fixed possible OOB read in smp_br_data_received 2025-12-16 17:37:14 +08:00
Jin Cheng 4466f5dd85 fix(bt/bluedroid): drop connection when atttempting to disable encryption 2025-12-16 17:37:14 +08:00
Jin Cheng cb1f8d1e15 fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd 2025-12-16 17:37:14 +08:00
Jin Cheng e65ef0995a fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl 2025-12-16 17:37:14 +08:00
Jin Cheng e4b54ede65 fix(bt/bluedroid): fixed an OOB bug in bta_av_setconfig_rej 2025-12-16 17:37:14 +08:00
Jin Cheng 0f9b02dd95 fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 7a45769e25 fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 25b2c79269 fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete 2025-12-16 17:37:14 +08:00
Jin Cheng d4c96f070c fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 1a944a4bed fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 69b47952e8 fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute 2025-12-16 17:37:14 +08:00
Jin Cheng 6fe7456575 fix(bt/bluedroid): report failure when not able to connect to AVRCP 2025-12-16 17:37:14 +08:00
Jin Cheng 5ab93b428d fix(bt/bluedroid): fixed buffer overflow in BRSF 2025-12-16 17:37:14 +08:00
Jin Cheng 0638ae7177 fix(bt/bluedroid): added negative length check in process_service_search_rsp 2025-12-16 17:37:14 +08:00
Jin Cheng 7cca70cd0d fix(bt/bluedroid): fixed OOB read in SDP server continuation length 2025-12-16 17:37:14 +08:00
Jin Cheng 131a4764c8 fix(bt/bluedroid): added length check when copy AVDTP packet 2025-12-16 17:37:14 +08:00
Jin Cheng 1d8f84701c fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET 2025-12-16 17:37:14 +08:00
Jin Cheng de4339d9d1 fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item 2025-12-16 17:37:14 +08:00
Jin Cheng 439c5cc93d fix(bt/bluedroid): added boundary check when reading SDP attribute response packet 2025-12-16 17:37:14 +08:00
Jin Cheng af9d55e487 fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp 2025-12-16 17:37:13 +08:00
Jin Cheng 7706e8abbc fix(bt/bluedroid): fixed potential OOB read in the reporting handler 
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
 2025-12-16 17:37:13 +08:00
Jin Cheng 8a44bd422d fix(bt/bluedroid): fixed a potential overflow about the media payload offset 
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
 2025-12-16 17:37:13 +08:00
Jin Cheng c07ac874ec fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2025-12-16 17:37:13 +08:00
Jin Cheng 801504e152 fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2025-12-16 17:37:13 +08:00
Jin Cheng b898e65794 fix(bt/bluedroid): reject device with same address in legacy paring 2025-12-16 17:37:13 +08:00
Jin Cheng 49195d826f fix(bt/bluedroid): ignore AVCT commands that are too long 2025-12-16 17:37:13 +08:00
Jin Cheng 2c2162efdc fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2025-12-16 17:37:13 +08:00
Jin Cheng fa76f4f10a fix(bt/bluedroid): make sure SDP only start discovery once 2025-12-16 17:37:13 +08:00
Jin Cheng 86d9063aac fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2025-12-16 17:37:13 +08:00
Jin Cheng 9a22611e30 fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-16 17:37:13 +08:00
Jin Cheng 1a27ef6d32 fix(bt/blurdoird): enable bitpool snity checks 2025-12-16 17:37:13 +08:00
Jin Cheng 65cb0be70f fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf 2025-12-15 19:29:20 +08:00
Jin Cheng bdf9592803 docs: update vulnerabilities guide to mention CVE-2025-66409 2025-12-11 14:10:54 +08:00
Jin Cheng b607198192 fix(bt/controller): Fixed some controller bugs 
- Fixed Bluetooth hardware error of 'CHMAP_ERROR'
- Fixed encryption collision bug
 2025-11-12 14:27:16 +08:00
Jin Cheng 6ca6f422da fix(bt/blurdoird): fixed an OOB write in bta_dm_sdp_result 2025-11-06 18:57:55 +08:00
Jin Cheng 565fa98d0c fix(bt/bluedroid): fixed potential OOB in AVRCP vendor command composition 2025-10-14 11:55:47 +08:00
Jin Cheng 3fa9d23ad2 fix(bt/controller): fixed several controller bugs 2025-09-29 09:59:42 +08:00
Jin Cheng ac2be3a58e fix(bt/controller): fixed the sniff anchor point can be mismatch from central and peripheral 2025-09-28 11:33:25 +08:00
JinCheng 5a6193ae14 fix(bluedroid): removed the code relying on compiler-specific extension for FAM in union 2025-09-27 11:28:54 +08:00
JinCheng 075ed218ca fix(bt/bluedroid): fixed potential OOB in Bluedroid 2025-09-25 10:20:10 +08:00
JinCheng fb04218563 fix(bt/bluedroid): update the COD before enabling inquiry scan 2025-08-25 15:53:48 +08:00
JinCheng 88722d50d5 fix(bt/controller): fixed some controller bugs 2025-08-13 19:27:35 +08:00
JinCheng 81d7ce47db fix(bt/bluedroid): correct a description error in the GAP header file 2025-08-13 19:27:35 +08:00
JinCheng 54f1f22e69 fix(esp_phy): update esp32 librtc.a for coex problems 
- ESP32 phy_version: 4861, b71b5ad, Aug, 5 2025
- ESP32 librtc version: 6758f983, Mar 22 2024, 13:39:26
 2025-08-05 12:08:57 +08:00
JinCheng 720108b220 fix(bt/bluedroid): safe string returns and cleanups for bt_discovery example 2025-08-01 09:40:21 +08:00
Jin Cheng b1ea7f7ae6 fix(bt/controller): update libbtdm_app.a 
- fixed errors in the coexistance of ACL and SCO
- fixed dynamic priority config error in dual mode
 2025-04-18 07:43:24 +08:00
Jin Cheng cd8fa5c46f fix(bt/bluedroid): fixed memory leaks in SPP callback mode 2025-02-26 19:12:47 +08:00
Jin Cheng 309747bf9a fix(bt/controller): fixed some controller bugs on ESP32. 
1. added a VSC to control whether to initiate lmp_auto_rate
        - Closes https://github.com/espressif/esp-idf/issues/15133
    2. fixed EA resource cleanup error after SNIFF negotiation failure
        - Closes https://github.com/espressif/esp-idf/issues/13605
    3. removed an assertion in SCO data TX handler after disconnection
        - Closes https://github.com/espressif/esp-idf/issues/15176
 2025-02-26 16:31:06 +08:00
Jin Cheng eb68ef4cc1 fix(bt/controller): fixed missing critical protections on linked-list structure of (e)SCO buffers 2025-01-07 18:56:23 +08:00
Jin Cheng 185b4d9d44 fix(bt/bluedroid): fixed access NULL in HFP callback handler 2024-12-05 13:19:18 +08:00
Jin Cheng 5e0a73bc56 fix(bt/controller): Fixed some bugs on esp32 controller 
- Added VSC to update local Bluetooth clock
    - Added critical protection for the free method for sync buffers
    - Fixed zero attempt value set by role switch
 2024-11-26 18:03:11 +08:00
Jin Cheng fdcf89ae6b feat(bt/bluedroid): added events to indicate the profile states of HFP 2024-11-22 17:14:16 +08:00
Jin Cheng 2b334d1dfa fix(bt/bluedroid): disconnect SDP connection on receiving incorrect response 2024-11-20 08:20:40 +08:00
Jin Cheng cfdefd3e03 fix(bt/controller): Fixed some controller bugs on ESP32 
- Fixed wrong logic in handling sniff transaction collision at slave
      side
    - Fixed the issue ACL is stopped too early before eSCO
 2024-11-08 12:53:56 +08:00
Jin Cheng c79eb0d5bf fix(bt/bluedroid): AG should send OK or other error codes to HF client 
when it is driven by HF to initiate a call.
 2024-11-08 12:51:00 +08:00
Jin Cheng e2241f1fc1 fix(bt/controller): Fixed some controller bugs on ESP32 
- Fixed access NULL in SCO frame end
      Closes https://jira.espressif.com:8443/browse/IDFGH-10796
    - Added LAP checking for Periodic Inquiry
    - Removed an inproper assertion in SCO module
    - Fixed wrong logic in key exchange when
      LMP transaction collision occurred
    - Fixed the using of wrong error code in
      the transaction collision of role switch
 2024-10-12 09:01:48 +08:00
Jin Cheng 9872a7bbd1 fix(bt/bluedroid): fixed AG and HF client cannot enter/exit sniff mode 2024-10-10 16:23:09 +08:00
Jin Cheng 6d85d86fe1 Revert "Disable sniff mode during (e)SCO connection." 
This reverts commit 39a5eb84f3.
 2024-10-10 16:10:11 +08:00
Jin Cheng 22fad3f0a8 fix(bt/controller): Fixed some controller bugs on ESP32 
- Fixed access NULL in SCO frame end
      Closes https://jira.espressif.com:8443/browse/IDFGH-10796
    - Added LAP checking for Periodic Inquiry
    - Removed an inproper assertion in SCO module
    - Fixed wrong logic in key exchange when
      LMP transaction collision occurred
    - Fixed the using of wrong error code in
      the transaction collision of role switch
 2024-09-23 15:33:11 +08:00
Jin Cheng 3964fb1fa8 fix(bt/controller): Removed an improper assertion in ACL link driver 
- See more from jira BT-3591
 2024-07-12 19:35:18 +08:00
Jin Cheng b79fcbb9d7 fix(bt/controller): Parse out the correct packet types from Host parameters 
- For HCI command HCI_Enhanced_Setup_Synchronous_Connection
 2024-04-30 17:38:58 +08:00
Jin Cheng 081dc80eb8 fix(bt/bluedroid): allocate memory for control block of HFP Audio Gateway in its initialization when dynamic memory is wnabled 2024-04-15 11:20:55 +08:00
Jin Cheng 98230244df fix(bt/controller): Use embedded assembly to get access to DPORT registers 2024-04-01 18:53:47 +08:00
Jin Cheng 82542d2e96 feat(bt/bluedroid): added a VSC to set minimal encryption key size 2024-03-25 10:50:06 +08:00