Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity
51,732 Commits 25 Branches 192 Tags
cd31c697c8a09ef6a1d71e53265c2516cde5b2bd
Commit Graph
35909 Commits
Author SHA1 Message Date
Jiang Jiang Jian 3befd9d774 Merge branch 'bugfix/add_en_rst_in_pvt_func_for_p4_backport_v6.0' into 'release/v6.0' 
fix(pvt): add en reset in pvt func for p4 on release v6.0

See merge request espressif/esp-idf!50882
 2026-07-20 11:39:00 +08:00
Jiang Jiang Jian f298dd2110 Merge branch 'bugfix/sdmmc-ddr-response-buffer-leak_v6.0' into 'release/v6.0' 
fix(sdmmc): free DMA response buffer on DDR mode switch failure (v6.0)

See merge request espressif/esp-idf!50886
 2026-07-20 10:45:54 +08:00
Jiang Jiang Jian d1d8dd478d Merge branch 'bugfix/nvs-flash-erase-partition-leak_v6.0' into 'release/v6.0' 
fix(nvs_flash): delete temporary NVSPartition after erase (v6.0)

See merge request espressif/esp-idf!50891
 2026-07-20 10:45:35 +08:00
Jiang Jiang Jian f24018d113 Merge branch 'feature/enable_zb_for_esp32p4_v6.0' into 'release/v6.0' 
feat(soc): enable zb* extensions for esp32p4 greater v3 (v6.0)

See merge request espressif/esp-idf!50779
 2026-07-20 10:44:17 +08:00
Jiang Jiang Jian 4f063a3166 Merge branch 'fix/bootloader_anti_rollback_konfig_v6.0' into 'release/v6.0' 
fix(bootloader): Hide bootloader anti-rollback Kconfig where not supported (v6.0)

See merge request espressif/esp-idf!50817
 2026-07-20 10:39:09 +08:00
Jiang Jiang Jian a1b0ace41b Merge branch 'fix/keep_use_secure_element_v6.0' into 'release/v6.0' 
fix(esp-tls): Keep deprecated use_secure_element field for compatibility (v6.0)

See merge request espressif/esp-idf!50780
 2026-07-20 10:38:38 +08:00
Jiang Jiang Jian f5323ed82c Merge branch 'contrib/github_pr_18817_v6.0' into 'release/v6.0' 
fix(wear_levelling): guard WL_Flash::write()/read() against size==0 underflow (GitHub PR) (v6.0)

See merge request espressif/esp-idf!50731
 2026-07-20 10:36:48 +08:00
Jiang Jiang Jian 21fdc1b01f Merge branch 'contrib/github_pr_18823_v6.0' into 'release/v6.0' 
fix(vfs): use MAX_FDS instead of VFS_MAX_COUNT when clearing fd table on unregister (GitHub PR) (v6.0)

See merge request espressif/esp-idf!50698
 2026-07-20 10:34:04 +08:00
Euripedes Rocha 493af45bb4 Merge branch 'fix/sec-1162-1189-1190-null-checks_v6.0' into 'release/v6.0' 
fix(esp_netif): harden NULL and OOM handling in netif APIs (SEC-1162, SEC-1189, SEC-1190) (v6.0)

See merge request espressif/esp-idf!50599
 2026-07-20 04:32:58 +02:00
Euripedes Rocha 533fdf256b Merge branch 'fix/sec-1137-br-glue-double-free_v6.0' into 'release/v6.0' 
fix(esp_netif): harden br_glue instance-handler cleanup against double-free (SEC-1137) (v6.0)

See merge request espressif/esp-idf!50643
 2026-07-20 04:32:26 +02:00
Jiang Jiang Jian d5e6becd46 Merge branch 'fix/lwip_sec_high_v6.0' into 'release/v6.0' 
fix(lwip): high severity lwip fixes (v6.0)

See merge request espressif/esp-idf!50591
 2026-07-20 10:30:51 +08:00
Aditya Patwardhan ce1dea564f fix(esp_http_server): reject Content-Length above UINT32_MAX 
In httpd_parse.c, cb_headers_complete() converted the HTTP parser's
content_length (uint64_t) to the request's content_len (size_t) via an
unsafe cast through (int). On a 32-bit size_t target a Content-Length
above 4 GiB silently truncated, enabling request smuggling where the
server and an upstream proxy disagree on the body length (CWE-681).

Reject any Content-Length above UINT32_MAX with 413 Content Too Large
before any handler runs. UINT32_MAX is the largest body length the
server can represent in size_t content_len on every target, so this is
the maximum the server can support; no configuration knob is needed.

Closes SEC-102
Closes SEC-229

(cherry picked from commit 9d3f510c7f)
 2026-07-20 10:29:46 +08:00
Ashish Sharma 7e36bb2db3 fix(esp_security): harden crypto peripheral error handling 2026-07-20 10:25:33 +08:00
Jiang Jiang Jian 55afa16a8a Merge branch 'backport/bdl_ioctl_checker_v6.0' into 'release/v6.0' 
feat(esp_blockdev): add build-time ioctl command reservation overlap checker (v6.0 backport)

See merge request espressif/esp-idf!50217
 2026-07-20 10:21:59 +08:00
Armando (Dou Yiwen) 19784893df fix: fixed image header segment count check 
Signed-off-by: Armando (Dou Yiwen) <douyiwen@espressif.com>
 2026-07-20 10:21:49 +08:00
Jin Chen 73b4ad275b change(ble): [AUTO_MR] Update lib_esp32c6 to 18aafc6f 
(cherry picked from commit 624845829a)

Co-authored-by: cjin <jinchen@espressif.com>
 2026-07-20 09:04:10 +08:00
Jin Chen 5c7f2a64e3 change(ble): [AUTO_MR] Update lib_esp32c5 to 18aafc6f 
(cherry picked from commit fa6e55229d)

Co-authored-by: cjin <jinchen@espressif.com>
 2026-07-20 09:04:10 +08:00
Jin Chen e7aa2b00ae change(ble): [AUTO_MR] Update lib_esp32h2 to 18aafc6f 
(cherry picked from commit d7b7876c3c)

Co-authored-by: cjin <jinchen@espressif.com>
 2026-07-20 09:04:09 +08:00
Wang Meng Yang bed9759dbb Merge branch 'bugfix/avrc_ca_attr_id_check_v6.0' into 'release/v6.0' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v6.0)

See merge request espressif/esp-idf!50550
 2026-07-19 14:37:06 +08:00
Wang Meng Yang e3a54f6673 Merge branch 'bugfix/fix_bredr_inq_crash_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v6.0)

See merge request espressif/esp-idf!50854
 2026-07-19 12:45:13 +08:00
yangfeng ca77dffadc fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-19 10:26:33 +08:00
yangfeng e472bc3868 fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC 
Closes SEC-1186
 2026-07-19 10:21:29 +08:00
yangfeng a3088cdce1 fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq 
Closes SEC-1187
 2026-07-19 10:21:29 +08:00
Rahul Tank 04ccb4c955 Merge branch 'bugfix/add_dis_ieee_udi_to_config_v6.0' into 'release/v6.0' 
fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v6.0)

See merge request espressif/esp-idf!50760
 2026-07-18 09:31:45 +05:30
Laukik Hase 3fd876dffa feat(esp_tee): Restrict REE access to TEE-owned secure storage keys 2026-07-17 18:15:37 +05:30
Laukik Hase c0b1a5a71c fix(esp_tee): Miscellaneous optimizations and fixes 
Closes https://github.com/espressif/esp-idf/issues/18591
 2026-07-17 18:15:37 +05:30
Ashish Sharma 8dc04e5fda fix(esp_tee): ensure hal assert is enabled for tee builds 2026-07-17 18:15:37 +05:30
Ashish Sharma dc44ca9a86 fix(esp_tee): enforce MMU-map vaddr validity at the REE->TEE boundary 2026-07-17 18:15:36 +05:30
Ashish Sharma 89ba3db529 fix(esp_tee): fixes IV length check for TEE AEAD operations 2026-07-17 18:15:36 +05:30
Wang Meng Yang e743ff2a10 Merge branch 'bugfix/smp_sec_flags_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v6.0)

See merge request espressif/esp-idf!50566
 2026-07-17 20:04:33 +08:00
sonika.rathi d776f4f09b fix(spiffs): shorten obj_name_len guard comment 2026-07-17 13:57:03 +02:00
tarun.kumar fd0d67c3dc fix(wifi): Correct blacklist flag 2026-07-17 17:09:24 +05:30
Wang Meng Yang 27a5aba8e1 Merge branch 'feat/ble_log_compression_module_cfg_update_v6.0' into 'release/v6.0' 
Feat/ble log compression module cfg update (6.0)

See merge request espressif/esp-idf!49875
 2026-07-17 19:35:49 +08:00
yi chen fde03cee88 fix(spiffs): fix off-by-one in spiffsgen.py obj name length check 
SpiffsFS.create_file() rejected names only when strictly longer than
obj_name_len, but CONFIG_SPIFFS_OBJ_NAME_LEN's documented semantics
(see components/spiffs/Kconfig) are that the length includes the
zero-termination character, so the maximum number of actual name
characters is obj_name_len - 1.

With the old check, a name exactly obj_name_len characters long was
accepted. SpiffsObjIndexPage.to_binary() then computes the NUL padding
after the name as (obj_name_len - len(name)), which is 0 in that case,
so the generated image's fixed-size name field ends up with no NUL
terminator anywhere in its reserved region.

Fix the boundary so the generator enforces the same maximum length
that the Kconfig help text documents.
 2026-07-17 13:03:30 +02:00
yi chen d057757a20 fix(esp_partition): prevent size_t overflow bypassing bounds checks on linux target 
esp_partition_write/read/erase_range/mmap in partition_linux.c (the
`linux` target backend used by --preview set-target linux / host_test)
validated the requested range with `offset + size > partition->size`.
When `size` is close to SIZE_MAX, this addition wraps around size_t and
can evaluate to a small value, so the check passes even though the
request is far out of bounds. A caller passing e.g.
esp_partition_write(partition, 1, src, SIZE_MAX) sails through both
bounds checks and reaches the byte-copy loop with new_size == SIZE_MAX,
causing out-of-bounds reads/writes far past both the caller's buffer
and the mmap'd emulated-flash file.

Replace all four instances with the overflow-safe form already used by
the other esp_partition backends (partition_target.c,
partition_bootloader.c, partition_tee.c):
`size > partition->size - offset`, which is safe because the preceding
check already guarantees offset <= partition->size.

Signed-off-by: yi chen <94xhn1@gmail.com>
 2026-07-17 12:48:48 +02:00
Martin Vychodil 326a998708 Merge branch 'fix/sdmmc_cmd_err_switch_case_handling_v6.0' into 'release/v6.0' 
fix(sdmmc): sdmmc_cmd.c fixed error handling in certain if and switch statements (v6.0)

See merge request espressif/esp-idf!50683
 2026-07-17 18:23:40 +08:00
Ashish Sharma 2c4bcab8d2 feat(mbedtls): enable cross signed certificate verification support by default 2026-07-17 18:12:56 +08:00
sonika.rathi 473dd30a96 fix(fatfs): move readdir-stat cache to per-DIR stream 
Move cached_fileinfo and dir_path from vfs_fat_ctx_t to vfs_fat_dir_t so
each open DIR* has its own readdir→stat cache.
 2026-07-17 12:09:26 +02:00
Sumeet Singh 73ef4148a8 fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v6.0) 2026-07-17 14:57:20 +05:30
sonika.rathi 3ad5251819 fix(nvs_flash): delete temporary NVSPartition after erase 2026-07-17 10:57:27 +02:00
sonika.rathi 849a342fe0 fix(sdmmc): free DMA response buffer on DDR mode switch failure 2026-07-17 10:47:47 +02:00
wuzhenghui 5d528ee6d4 feat(esp_hw_support): fix esp32p4 PVT retention link 2026-07-17 16:24:05 +08:00
yanzihan@espressif.com d6e6ee1dbb feat(pvt): add en reset in pvt func for p4 on master 2026-07-17 16:23:53 +08:00
Jiang Jiang Jian a89931243c Merge branch 'bugfix/change_pvt_timer_target_param_backport_v6.0' into 'release/v6.0' 
feat(pvt): change pvt timer target & limit on release v6.0

See merge request espressif/esp-idf!50814
 2026-07-17 16:13:16 +08:00
Chen Chen 5c7be29ef2 refactor(i2s): make the slot_bit_width checks unique 2026-07-17 14:38:27 +08:00
Chen Chen 47bb180049 feat(i2s): allow full duplex mode in less strict condition 2026-07-17 14:38:27 +08:00
Rahul Tank 6a24b81921 Merge branch 'bugfix/add_extra_prints_v6.0' into 'release/v6.0' 
fix(nimble): Remove SOC_ESP_NIMBLE_CONTROLLER from unnecessary locations (v6.0)

See merge request espressif/esp-idf!50095
 2026-07-17 10:42:27 +05:30
morris afb9f5a719 Merge branch 'feat/csi_error_event_v6.0' into 'release/v6.0' 
Add MIPI-CSI error event (v6.0)

See merge request espressif/esp-idf!50681
 2026-07-17 12:17:02 +08:00
Jiang Jiang Jian 7c49a6a4d8 Merge branch 'fix/move_cache_lock_workaround_out_of_ipc_stall_v6.0' into 'release/v6.0' 
fix(esp_hw_support): disable esp32 livelock workaround before stall another core (v6.0)

See merge request espressif/esp-idf!50770
 2026-07-17 11:26:23 +08:00
linruihao eb81835174 fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:19 +08:00