Sajia
884036b072
fix(wifi): Prevent double free in owe failure path
2026-08-10 12:03:55 +05:30
Jiang Jiang Jian
d6ad1232ae
Merge branch 'bugfix/dpp_backport_v5.4' into 'release/v5.4'
...
fix(esp_wifi): Backport dpp and other fixes
See merge request espressif/esp-idf!51411
2026-08-06 16:19:17 +08:00
Jiang Jiang Jian
54d648e703
Merge branch 'fix/154_mac_receive_at_v5.4' into 'release/v5.4'
...
fix(ieee802154): skip receive_at when rx window already expired (v5.4)
See merge request espressif/esp-idf!51369
2026-08-06 12:29:09 +08:00
Jiang Jiang Jian
6c0799d334
Merge branch 'backport/lp_spi_fix_inline_v5.4' into 'release/v5.4'
...
fix(ulp/lp_spi): fix stale data in driver (v5.4)
See merge request espressif/esp-idf!51312
2026-08-06 12:02:40 +08:00
Jiang Jiang Jian
4cd8933eb7
Merge branch 'test/run_supported_cmake_tests_v5.4' into 'release/v5.4'
...
test(tools): Added minimal supported cmake versions build system tests (v5.4)
See merge request espressif/esp-idf!51114
2026-08-06 11:59:50 +08:00
Jiang Jiang Jian
8a5cd6c388
Merge branch 'bugfix/vfs_fat_readdir_stat_cache_v5.4' into 'release/v5.4'
...
fix(fatfs): move readdir-stat cache to per-DIR stream (v5.4)
See merge request espressif/esp-idf!50906
2026-08-06 11:58:23 +08:00
Jiang Jiang Jian
5e6450fb55
Merge branch 'contrib/github_pr_18829_v5.4' into 'release/v5.4'
...
fix(spiffs): fix off-by-one in spiffsgen.py obj name length check (GitHub PR) (v5.4)
See merge request espressif/esp-idf!50917
2026-08-06 11:55:13 +08:00
Jiang Jiang Jian
1788bf7d9e
Merge branch 'contrib/github_pr_18822_v5.4' into 'release/v5.4'
...
fix(esp_partition): prevent size_t overflow bypassing bounds checks on linux target (GitHub PR) (v5.4)
See merge request espressif/esp-idf!50910
2026-08-06 11:54:59 +08:00
Jiang Jiang Jian
5b2f687142
Merge branch 'bugfix/sdmmc-ddr-response-buffer-leak_v5.4' into 'release/v5.4'
...
fix(sdmmc): free DMA response buffer on DDR mode switch failure (v5.4)
See merge request espressif/esp-idf!50888
2026-08-06 11:54:26 +08:00
Jiang Jiang Jian
ac3962b03a
Merge branch 'test/idf-additions-coverage_v5.4' into 'release/v5.4'
...
test(freertos): expand IDF additions test coverage (v5.4)
See merge request espressif/esp-idf!50822
2026-08-06 11:51:50 +08:00
Jiang Jiang Jian
cc718ffa69
Merge branch 'contrib/github_pr_18823_v5.4' into 'release/v5.4'
...
fix(vfs): use MAX_FDS instead of VFS_MAX_COUNT when clearing fd table on unregister (GitHub PR) (v5.4)
See merge request espressif/esp-idf!50700
2026-08-06 11:51:18 +08:00
Jiang Jiang Jian
f9f69f0cae
Merge branch 'lwip/dns_stack_corruption_fix_v5.4' into 'release/v5.4'
...
docs(lwip): clarify DNS_MAX_HOST_IP range and addr_cnt in Kconfig (v5.4)
See merge request espressif/esp-idf!49194
2026-08-06 11:50:28 +08:00
Jiang Jiang Jian
cd6850cf55
Merge branch 'opt/hfp_audio_quality_v5.4' into 'release/v5.4'
...
change(bt/bluedroid): optimized the HFP example workflow to improve audio quality (v5.4)
See merge request espressif/esp-idf!51551
2026-08-06 11:31:47 +08:00
Jiang Jiang Jian
355264d7f7
Merge branch 'feat/ot_rx_sensitivity_v5.4' into 'release/v5.4'
...
feat(openthread): use the actual receive sensitivity for link quality evaluation (v5.4)
See merge request espressif/esp-idf!51483
2026-08-06 11:27:25 +08:00
Jiang Jiang Jian
8f810bd44c
Merge branch 'feat/support_pawr_connect_evt_v5.4' into 'release/v5.4'
...
feat(ble/bluedroid): Support PAWR connection event (5.4)
See merge request espressif/esp-idf!51440
2026-08-06 11:25:37 +08:00
Jiang Jiang Jian
5ecf5638ba
Merge branch 'fix/resolve_issues_reported_via_bbp_v5.4' into 'release/v5.4'
...
fix(openthread): fix null pointer deref, uninitialized struct, and unbounded strcpy in spinel/RCP code (v5.4)
See merge request espressif/esp-idf!51371
2026-08-06 11:23:23 +08:00
Jiang Jiang Jian
22ca67b85a
Merge branch 'fix/fatfs_vulnerabilities_v5.4' into 'release/v5.4'
...
fix(fatfs): harden against runZero 2026 FatFs bugs (v5.4)
See merge request espressif/esp-idf!50427
2026-08-06 11:20:41 +08:00
Shreyas Sheth
8a2ad321d5
fix(esp_wifi): Backport dpp and other fixes
...
1) Fix crash while connecting to dpp akm
2) Fix phy ref cnt for power management for offchannel_tx
3) Introduced a variable to indicate dpp ap for scan results
4) Introduced WIFI_AUTH_UNKNOWN for ap with misconfigured security parameter
2026-08-05 19:55:26 +05:30
Jin Cheng
6d83ab5035
change(bt/bluedroid): optimized the HFP example workflow to improve audio quality
...
Disabled inquiry scan and page scan after SCO connection establishment
to reduce over-the-air bandwidth usage and improve audio quality by
prevent scan activities from interrupting SCO traffic.
2026-08-05 18:01:21 +08:00
Island
c8585795ec
Merge branch 'fix/ble_mesh_added_gatt_err_rsp_v5.4' into 'release/v5.4'
...
fix(ble_mesh): align GATTS read/write response handling with ATT (5.4)
See merge request espressif/esp-idf!51461
2026-08-05 16:03:00 +08:00
zwx
5f725faa7d
fix(ieee802154): skip receive_at when rx window already expired
2026-08-05 06:59:17 +00:00
zwx
d1af6ebf89
fix(openthread): fix null pointer deref, uninitialized struct, and unbounded strcpy in spinel/RCP code
2026-08-05 06:58:54 +00:00
Wang Meng Yang
a3e1f55f3e
Merge branch 'feat/bt_in_psram_v5.4' into 'release/v5.4'
...
feat(bluedroid): Add config to place btu and hci task stack in psram (v5.4)
See merge request espressif/esp-idf!51493
2026-08-05 14:26:37 +08:00
Jiang Jiang Jian
9120300402
Merge branch 'contrib/github_pr_18817_v5.4' into 'release/v5.4'
...
fix(wear_levelling): guard WL_Flash::write()/read() against size==0 underflow (GitHub PR) (v5.4)
See merge request espressif/esp-idf!50733
2026-08-05 12:23:09 +08:00
Jiang Jiang Jian
dc7c4c882c
Merge branch 'fix/rtc_retain_mem_sb_fast_wakeup_ptr_v5.4' into 'release/v5.4'
...
fix(bootloader_support): fix RTC retain mem offset for secure boot fast wakeup (v5.4)
See merge request espressif/esp-idf!51269
2026-08-05 10:44:11 +08:00
Island
8c3500b917
Merge branch 'fix/ble_log_compression_add_local_header_file_v5.4' into 'release/v5.4'
...
feat(ble_log): mirror local compression headers (5.4)
See merge request espressif/esp-idf!50950
2026-08-05 10:06:54 +08:00
Jiang Jiang Jian
7ef63043e0
Merge branch 'bugfix/nan_vulnerabilities_v5.4' into 'release/v5.4'
...
fix(nan): Fix bug bounty reported and discovered vulnerabilities in NAN Rx (Backport v5.4)
See merge request espressif/esp-idf!51303
2026-08-04 20:37:26 +08:00
Euripedes Rocha
6dccb29a0f
Merge branch 'fix/sec-1129-l2tap-close-rollback_v5.4' into 'release/v5.4'
...
fix(esp_netif): roll back l2tap_close on semaphore/task create failure (SEC-1129) (v5.4)
See merge request espressif/esp-idf!51400
2026-08-04 09:07:46 +02:00
hejiaxin
7c48812de9
feat(bluedroid): Add config to place btu and hci task stack in psram
...
- Also adjust the osi_thread_stop implementation.
2026-08-04 14:56:04 +08:00
Rahul Tank
6891e46417
Merge branch 'bugfix/add_nimble_cve_v5.4' into 'release/v5.4'
...
fix(nimble): Fixes for various NimBLE CVEs (v5.4)
See merge request espressif/esp-idf!51203
2026-08-04 12:15:02 +05:30
Shu Chen
3c7136dbff
feat(openthread): use the actual receive sensitivity for link quality evaluation
2026-08-04 14:40:46 +08:00
Wang Meng Yang
8945329c8b
Merge branch 'fix/aireview_critical_v5.4' into 'release/v5.4'
...
fix: Fix some critical bugs in classic bt (v5.4)
See merge request espressif/esp-idf!51291
2026-08-04 14:16:22 +08:00
Wang Meng Yang
5340a84fc8
Merge branch 'fix/bluedroid_aireview_v5.4' into 'release/v5.4'
...
Fix/bluedroid aireview (v5.4)
See merge request espressif/esp-idf!51296
2026-08-04 14:12:25 +08:00
Luo Xu
e2114de7b0
feat(ble_log): mirror local compression headers
...
(cherry picked from commit ee732a4591 )
Co-authored-by: luoxu <luoxu@espressif.com >
2026-08-04 11:53:15 +08:00
Rahul Tank
81d5a89bd9
fix(nimble): Fixes for various NimBLE CVEs
2026-08-03 23:47:07 +05:30
Euripedes Rocha Filho
24c3b92449
fix(esp_netif): Avoid socket to stay in closing state in l2tap closing
2026-08-03 16:14:32 +02:00
Luo Xu
696ea1bb08
fix(ble_mesh): align GATTS read/write response handling with ATT
...
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
(cherry picked from commit ed1f4de3a3 )
Co-authored-by: luoxu <luoxu@espressif.com >
2026-08-03 21:43:43 +08:00
Zhi Wei Jian
d7ae97ec69
fix(ble/bluedroid): Build LE event mask from host feature macros
...
(cherry picked from commit 68dff5d798 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-08-03 15:25:46 +08:00
Zhi Wei Jian
b5dfde1c9e
feat(ble/bluedroid): Support PAWR connection event
...
(cherry picked from commit 7da7fa42ac )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-08-03 15:25:46 +08:00
Island
ccd00fb116
Merge branch 'fix/ble_log_compression_issue_on_windows_v5.4' into 'release/v5.4'
...
fix(bt): fix BLE log compression build on Windows (5.4)
See merge request espressif/esp-idf!51244
2026-08-03 11:31:06 +08:00
Island
102d8c1141
Merge branch 'feat/update_mesh_lib_to_supported_get_lib_ver_v5.4' into 'release/v5.4'
...
Feat/update mesh lib to supported get lib ver (5.4)
See merge request espressif/esp-idf!51171
2026-08-03 11:30:27 +08:00
Martin Vychodil
102a347903
Merge branch 'bugfix/idfci-12815-12072-timeout_v5.4' into 'release/v5.4'
...
fix(storage): mark storage pytest apps flaky in CI (v5.4)
See merge request espressif/esp-idf!51338
2026-08-02 16:40:10 +08:00
Abhik Roy
6625eb9e44
docs(lwip): document LWIP_DNS_MAX_HOST_IP range and addr_cnt usage
...
The DNS buffer overflow fix (esp-lwip@6233a1561) is already included in
release/v5.4 via 882843dbf8 . This commit only adds Kconfig documentation
for the DNS_MAX_HOST_IP range and addr_cnt API contract.
2026-07-31 21:21:50 +10:00
sonika.rathi
bdeb413603
fix(storage): mark storage pytest apps flaky in CI
2026-07-31 08:55:18 +02:00
Akshat Agrawal
b08c5f7a22
fix(nan): Fix bug bounty reported and discovered vulnerabilities in NAN Rx
2026-07-31 11:38:48 +05:30
Island
ffc7e0dd66
Merge branch 'fix/fix_some_ble_sleep_issues_v5.4' into 'release/v5.4'
...
Fix/fix some ble sleep issues (5.4)
See merge request espressif/esp-idf!51317
2026-07-31 11:10:02 +08:00
harshal.patil
6618558e7b
refactor(esp_system): deduplicate ROM fast wake RTC digest reservation
...
The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
2026-07-31 11:05:47 +08:00
hejiaxin
3552cb670a
fix(bt_stack): Fix some critical bugs in classic_bt stack
...
related: obex, smp, pbap, sdp, rfcomm, stack_dm
- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
2026-07-31 10:46:31 +08:00
Luo Xu and Wang Mengyang
6d21650c9c
fix(bt): Fixed build error on array-bounds in HFP AG
...
(cherry picked from commit bbd20cae01 )
Co-authored-by: Wang Mengyang <wangmengyang@espressif.com >
2026-07-31 00:04:50 +08:00
Rahul Tank
4f16f3d939
Merge branch 'bugfix/fix_pawr_conn_event_v5.4' into 'release/v5.4'
...
fix(nimble): Deliver PAwR peripheral CONNECT via sync callback (v5.4)
See merge request espressif/esp-idf!51255
2026-07-30 20:40:27 +05:30