Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 10:40:47 +03:00
Code Issues Packages Projects Releases Wiki Activity
41,495 Commits 25 Branches 192 Tags
c2cf36d98c2e73a6b3fef78b2c44bd77ebbd42fa
Commit Graph
1708 Commits
Author SHA1 Message Date
Jin Cheng c2cf36d98c fix(bt/bluedroid): added negative length check in process_service_search_rsp 2026-01-22 10:53:51 +08:00
Jin Cheng 13033abfe0 fix(bt/bluedroid): fixed OOB read in SDP server continuation length 2026-01-22 10:53:51 +08:00
Jin Cheng 91b76926aa fix(bt/bluedroid): added length check when copy AVDTP packet 2026-01-22 10:53:51 +08:00
Jin Cheng 09f381ba97 fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET 2026-01-22 10:53:51 +08:00
Jin Cheng 80fda864ad fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item 2026-01-22 10:53:51 +08:00
Jin Cheng 0084b75e2d fix(bt/bluedroid): added boundary check when reading SDP attribute response packet 2026-01-22 10:53:51 +08:00
Jin Cheng 4d13c41ce8 fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp 2026-01-22 10:53:51 +08:00
Jin Cheng 4e47e20177 fix(bt/bluedroid): fixed potential OOB read in the reporting handler 
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
 2026-01-22 10:53:51 +08:00
Jin Cheng bca3ea13f6 fix(bt/bluedroid): fixed a potential overflow about the media payload offset 
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
 2026-01-22 10:53:51 +08:00
Jin Cheng 0296e64d35 fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2026-01-22 10:53:51 +08:00
Jin Cheng 56494d664e fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2026-01-22 10:53:51 +08:00
Jin Cheng 516a54f0fb fix(bt/bluedroid): reject device with same address in legacy paring 2026-01-22 10:53:51 +08:00
Jin Cheng 2cb39d84aa fix(bt/bluedroid): ignore AVCT commands that are too long 2026-01-22 10:53:51 +08:00
Jin Cheng 2e9a6554e4 fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2026-01-22 10:53:51 +08:00
Jin Cheng dfad85a5cd fix(bt/bluedroid): make sure SDP only start discovery once 2026-01-22 10:53:51 +08:00
Jin Cheng e2c0498697 fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2026-01-22 10:53:51 +08:00
Jin Cheng 2f17f9ffd7 fix(bt/blurdoird): check Classic key before cross-key derivation 2026-01-22 10:53:51 +08:00
Jin Cheng 87740ade2d fix(bt/blurdoird): enable bitpool snity checks 2026-01-22 10:53:51 +08:00
Wang Meng Yang df554b5b54 Merge branch 'bugfix/source_acp_miss_audio_cfg_evt_v5.3' into 'release/v5.3' 
Bugfix/source acp miss audio cfg evt v5.3

See merge request espressif/esp-idf!45260
 2026-01-21 19:13:30 +08:00
Jin Cheng a01b303dd0 fix(bt): enhanced packet length check in sdp_server.c 2026-01-20 13:02:34 +08:00
Jin Cheng d354d9f984 fix(bt): enhanced packet length check for avrc_pars_vendor_cmd 2026-01-20 13:02:34 +08:00
Jin Cheng bbfdb8d845 fix(bt): enhanced packet length check for HCI module 2026-01-20 13:02:34 +08:00
Jin Cheng af49a2dccd fix(bt): validated UUID parameters in BTA_JvStartDiscovery 2026-01-20 13:02:34 +08:00
Zhou Xiaoandcjin 009a956581 feat(ble): add config to enable sid filter feat 
(cherry picked from commit 3bf230435c)

Co-authored-by: cjin <jinchen@espressif.com>
 2026-01-19 14:19:29 +08:00
Island 9c66d3416f Merge branch 'fix/uaf_in_bluedroid_attp_v5.3' into 'release/v5.3' 
fix(ble): fixed use-after-free in bluedroid attp (v5.3)

See merge request espressif/esp-idf!45157
 2026-01-16 19:04:52 +08:00
Island a13e0e2873 Merge branch 'feat/ble_log_hci_log_len_limit_support_v5.3' into 'release/v5.3' 
Feat/ble log hci log len limit support (v5.3)

See merge request espressif/esp-idf!45146
 2026-01-16 19:03:17 +08:00
Rahul Tank 5156402858 Merge branch 'bugfix/periodic_adv_sync_lost_psync_handle_v5.3' into 'release/v5.3' 
fix(nimble): Handling of psync during sync lost (v5.3)

See merge request espressif/esp-idf!45045
 2026-01-16 12:27:41 +05:30
Island 9dac52c2e5 Merge branch 'feat/support_blecrt_515_v5.3' into 'release/v5.3' 
feat(bt/bluedroid): Support get allocated heap size (v5.3)

See merge request espressif/esp-idf!44861
 2026-01-16 14:19:01 +08:00
Zhou Xiao b1d24cc218 fix(ble): fixed use-after-free in bluedroid attp 
(cherry picked from commit 78594e0f6e)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
 2026-01-15 19:13:21 +08:00
Zhou Xiao 8897477626 feat(ble): added sdkconfig to control ble host side hci log 
(cherry picked from commit 52c2bd2dd6)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
 2026-01-15 17:13:20 +08:00
Wang Meng Yang 7fd2c9a77c Merge branch 'bugfix/l2cap_malloc_fail_v5.3' into 'release/v5.3' 
fix(bt): fix l2cap malloc fail in throughput test(v5.3)

See merge request espressif/esp-idf!44849
 2026-01-14 20:05:21 +08:00
Astha Verma 36a3e93cb9 fix(nimble): Handling of psync during synchronization timeout (0x3e) 2026-01-14 13:40:12 +05:30
xiongweichao 556af73952 fix(bt): retry when L2CAP write fails 2026-01-12 06:09:35 +00:00
xiongweichao 964c3e4db6 fix(bt): fix l2cap malloc fail in throughput test 2026-01-12 06:09:35 +00:00
yangfeng fe976dec92 docs(bt): update Classic Bluetooth api reference of SDP 2026-01-12 10:59:10 +08:00
yangfeng dea96e254f docs(bt): update Classic Bluetooth api reference of L2CAP 2026-01-12 10:59:08 +08:00
yangfeng b0929670cf docs(bt): update Classic Bluetooth api reference of HID Host 2026-01-12 10:58:30 +08:00
yangfeng adb163d9b3 docs(bt): update Classic Bluetooth api reference of HID Device 2026-01-12 10:58:30 +08:00
yangfeng 27ad163c7f docs(bt): update Classic Bluetooth api reference of HFP AG 2026-01-12 10:58:30 +08:00
yangfeng 51f1f0207f docs(bt): update Classic Bluetooth api reference of HFP Client 2026-01-12 10:58:30 +08:00
yangfeng fcb0242dca docs(bt): update Classic Bluetooth api reference of HFP Define 2026-01-12 10:58:30 +08:00
yangfeng 97065c7bb6 docs(bt): update Classic Bluetooth api reference of SPP 2026-01-12 10:58:30 +08:00
yangfeng 53e596c06d docs(bt): update Classic Bluetooth api reference of AVRCP 2026-01-12 10:58:29 +08:00
yangfeng e3e958c9b1 docs(bt): update Classic Bluetooth api reference of A2DP 2026-01-12 10:56:54 +08:00
yangfeng 3455af6904 docs(bt): update Classic Bluetooth api reference of GAP 2026-01-12 10:55:22 +08:00
Island 6cd6db4d63 Merge branch 'bugfix/fix_ble_security_issue_2025_v3_v5.3' into 'release/v5.3' 
fix(ble/bluedroid): Fix type mismatch and length validation in HCI packet parser (v5.3)

See merge request espressif/esp-idf!44665
 2026-01-09 11:43:41 +08:00
zhiweijian b60999808c fix(ble/bluedroid): Fixed bluedroid host get white list size error 2026-01-07 20:31:06 +08:00
zhiweijian 089f7642cc fix(ble/bluedroid): Fixed bt buuld error 
fix(ble/bluedroid): disable power management if bt is disabled
 2026-01-07 18:05:57 +08:00
zhiweijian 0c14518ddc fix(ble/bluedroid): disable some member in tBTA_SYS_CB 2026-01-07 18:05:41 +08:00
zhiweijian ce9156b00e fix(ble/bluedroid): optimize bluedroid host code 2026-01-07 18:05:28 +08:00