Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
55,493 Commits 25 Branches 192 Tags
cfce9ef45afbb28eb32bc8bbf191df87842fed5a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jin Cheng cfce9ef45a fix(bt/controller): Fixed wrong version of btdm_common used by BR/EDR 
- Sync btdm_common at BR/EDR side
- Enabled BTLC timer overflow interrupt
- Check the btdm version used by BR/EDR during controller initialization
 2026-09-16 17:43:24 +08:00
Jin Cheng dc912771aa fix(bt/bluedroid): fixed OOB read dring mSBC sync word check 2026-09-07 15:24:41 +08:00
Jin Cheng 329731b91a fix(bt/controller): update ESP32 libbtdm_app.a to fix missing QoS_Setup_Cmpl event 2026-09-07 12:17:53 +08:00
Jin Cheng a2911b1b0d docs: update vulnerabilities guide to mention CVE-2026-81507 & CVE-2026-81508 2026-08-31 16:34:11 +08:00
Jin Cheng 2e9769d270 fix(bt/controller): update libbtdm_common_app.a to f60e5b29 
- fixed BT ASSERT ID 8486
- relates to BTQABR2023-884
 2026-08-27 15:51:59 +08:00
Jin Cheng 347b2461ae fix(bt/bluedroid): fixed BTA event dispatch race during module disable 
- Gate bta_sys_event() on both 'is_reg' and 'reg[id]' to prevent
  stale event delivery.
- Defer bta_sys_deregister() to the end of profile disable handlers
  to ensure pending DISABLE events are processed.
- Add disabling flag to HFP AG for tracking asynchronous teardown.
 2026-08-19 15:04:37 +08:00
Jin Cheng 1e511cff5f fix(bt/bluedroid): fixed the function prototype of the command handler of READ LOCAL SUPPORTED CODECS 2026-08-18 09:49:24 +08:00
Jin Cheng f9bc23d1ad fix(bt): update ESP32 libbtdm_app.a to fix several issues 
- fixed IntegerDividedByZero during Qos negotiation.
  Closes https://github.com/espressif/esp-idf/issues/18951
- ignored the check for bandwidth and retransmission effort when Host
  accepts the SCO connection request.
 2026-08-13 09:26:15 +08:00
Jin Cheng 7a05c18999 change(bt/bluedroid): optimized the HFP example workflow to improve audio quality 
Disabled inquiry scan and page scan after SCO connection establishment
to reduce over-the-air bandwidth usage and improve audio quality by
prevent scan activities from interrupting SCO traffic.
 2026-07-30 14:58:21 +08:00
Jin Cheng c274987a7a fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-07-28 15:21:29 +08:00
Jin Cheng 1336f62653 change(bt/bluedroid): increased port low watermark of RFCOMM 
When PORT_RX_BUF_LOW_WM is too low, RFCOMM replenishes credits only
after receiving a relatively large number of packets, which may cause
the peer to exhaust its credits and enter a stop-and-wait state.
Increase the low watermark to replenish credits more promptly and
reduce the likelihood of the peer stalling while waiting for additional
credits.
 2026-07-21 19:29:08 +08:00
Jin Cheng 970923ba7d fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-17 17:15:56 +08:00
Jin Cheng a556efccc7 fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act 
Closes SEC-786
 2026-07-14 07:58:55 +08:00
Jin Cheng eaa2d0d13c fix(bt/bluedroid): fixed OOB read in PBAP app parameter parsing 
Closes SEC-713
 2026-07-02 20:22:37 +08:00
Jin Cheng e1c3b2b5e4 fix(bt/bluedroid): fixed stuck sec_state on authention HCI command send failure 
Closes SEC-1164
 2026-07-02 20:22:37 +08:00
Jin Cheng 1ca06c23b6 fix(bt/bluedroid): fixed HID host slot leak on local VUP ACL drop 
Closes SEC-1169
 2026-07-02 20:22:37 +08:00
Jin Cheng 4ccff38c54 fix(bt/bluedroid): fixed NULL dereference in remote legacy authentication handler 
Closes SEC-1143
 2026-07-02 20:22:37 +08:00
Jin Cheng ed287a280d fix(bt/bluedroid): fixed integer overflow in HID report descriptor parser 
Closes SEC-084
 2026-07-02 20:22:37 +08:00
Jin Cheng 4bf16541ad fix(bt/bluedroid): fixed wrong link key flag cleared on legacy BR/EDR authentication failure 
Stale bond trust state cound remain after authenticaion failure, causing
incorrect bond status and link key auto-reply behavior.

Closes SEC-1153
 2026-07-02 20:21:43 +08:00
Jin Cheng 6cb20db4df fix(bt/bluedroid): fixed possible OOB write in btc_a2dp_sink_handle_inc_media 2026-06-15 20:26:48 +08:00
Jin Cheng bd60b1c267 fix(bt/bluedroid): fixed possible OOB read/write in process_l2cap_cmd 2026-06-15 20:26:15 +08:00
Jin Cheng 676fd45ec9 fix(bt/controller): fixed several BR/EDR controller bugs found by WVT regression tests on ESP32 2026-06-15 15:26:09 +08:00
Jin Cheng 6979093544 fix(bt/bluedroid): added buffer length check for HID Device data indication 2026-06-12 12:18:02 +08:00
Jin Cheng 0970c5accb fix(bt/controller): fixed several BR/EDR controller bugs found by WVT regression tests on ESP32-S31 2026-06-12 07:48:27 +08:00
Jin Cheng 149743a8d5 fix(bt/bluedroid): fixed CTKD link key authentication downgrade in SC-Only mode 2026-06-10 08:43:42 +08:00
Jin Cheng c8cd8f4f30 fix(bt/bluedroid): added buffer length check for L2CAP related functions 2026-06-09 17:57:46 +08:00
Jin Cheng 06a53ca900 fix(bt/bluedroid): added buffer length check for OBEX APIs 2026-06-09 17:57:08 +08:00
Jin Cheng 5a3d291bef fix(bt/bluedroid): added buffer length check for HID host data indication 2026-06-09 17:55:35 +08:00
Jin Cheng d6a49aedef fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received 2026-06-09 17:11:08 +08:00
Jin Cheng e4806d9bc3 fix(bt/controller): fixed several BR/EDR controller bugs found by WVT regression tests on ESP32-S31 2026-06-08 11:58:16 +08:00
Jin Cheng 5d0b77797b fix(bt/bluedroid): fixed SDP deinit race with pending callbacks 
Cancel any active SDP search during disabling and mark the BTA SDP
callbacks inactive so late search completions are not propagated
after deinit. Guard BTC side SDP completion handling after cleanup
to avoid null references.
 2026-05-21 20:33:35 +08:00
Jin Cheng 2ea0396135 fix(bt/controller): fixed several controller issues 
- added support for PCM over I2S
- ignored bandwidth and retransmission effort during SCO negotiation
- fixed use-after-free issues while handle the saved PDU
- removed unreasonable check for the packet write-back value
- fixed SSP unhandle LMP_NOT_ACCEPTED
- removed incorrect clearing of ACL flags
- fixed incorrect strategy to narrow down allowed packet types during
  eSCO negotiation
 2026-05-21 15:12:14 +08:00
Jin Cheng 4905a0aeb2 feat(ci): added example tests for HFP using external codec 2026-05-14 12:10:47 +08:00
Jin Cheng bd8078ca04 fix(bt/bluedroid): fixed building errors in HFP datapath 2026-05-14 10:35:25 +08:00
Jin Cheng 4f233e304c fix(bt/bluedroid): fixed the vulerabilities from AI code review in HID 2026-05-06 18:29:08 +08:00
Jin Cheng af9ec3cd58 fix(bt/bluedroid): fixed the vulerabilities from AI code review in Bluedroid 2026-05-06 18:05:14 +08:00
Jin Cheng 83ede08702 fix(bt/controller): fixed sevaral controller issues 
- Relax the TID checks during EPR to be compatible with some RealTek devices
        - Closes https://github.com/espressif/esp-idf/issues/18145
    - Fixed wrong HCI event used for eSCO connection update
    - Do not inform the host when conneciton request was automatically rejected
 2026-04-16 20:27:47 +08:00
Jin Cheng 8999e14df8 fix(bt/bluedroid): moved L2CAP length check into start packets only 2026-04-08 20:13:37 +08:00
Jin Cheng c9a11c1ff9 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in SBC 2026-04-01 09:42:51 +08:00
Jin Cheng ed270d71c8 fix(bt/bluedroid): fixed the vulerabilities from AI code review in SPP 2026-03-30 17:38:46 +08:00
Jin Cheng 6702e66dd8 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in Bluedroid 2026-03-27 11:28:37 +08:00
Jin Cheng 42f3ed145d fix(bt/bluedroid): flushed all the DM PM at the end of SPP deinit 2026-03-27 11:20:54 +08:00
Jin Cheng dba6432d81 fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in SPP 2026-03-23 11:22:06 +08:00
Jin Cheng 6b7909f20e fix(bt/bluedroid): fixed multiple high-severity issues from AI code review in HID 2026-03-23 09:48:10 +08:00
Jin Cheng 34143d48ee fix(bt/bluedroid): fixed possible use of uninitialized stack variables in bt_hf_client_at.c 2026-03-16 12:09:06 +08:00
Jin Cheng 60f9362f83 fix(bt/bluedroid): fixed possible OOB read in avrc_pars_vendor_cmd 2026-03-10 08:43:56 +08:00
Jin Cheng 588b03d0d8 fix(bt/controller): fixed remote LMP_AU_RAND is mistakely rejected 2026-02-25 11:05:39 +08:00
Jin Cheng f694fc15ce fix(bt): fixed semaphore deletion condition in UART DMA deinit 2026-01-15 10:04:22 +08:00
Jin Cheng bdec9fe83a fix(bt): enhanced packet length check in sdp_server.c 2026-01-15 10:04:22 +08:00
Jin Cheng b18f09fc54 fix(bt): enhanced packet length check for avrc_pars_vendor_cmd 2026-01-15 10:04:22 +08:00
Jin Cheng 2566cc6609 fix(bt): enhanced packet length check for HCI module 2026-01-15 10:04:22 +08:00
Jin Cheng 36b9f5270a fix(bt): validated UUID parameters in BTA_JvStartDiscovery 2026-01-15 10:04:22 +08:00
Jin Cheng 0717ae3acf fix(bt/bluedroid): A2DP source at acceptor side will miss ESP_A2D_AUDIO_CFG_EVT 2026-01-13 10:14:43 +08:00
Jin Cheng 4adb4b9010 fix(bt/bluedroid): add status management for audio sink service channel 2026-01-12 19:16:33 +08:00
Jin Cheng 44b05258d7 fix(bt/controller): fixed wrong key type during changing connection link key 2026-01-05 17:34:26 +08:00
Jin Cheng c1fdcddac4 docs: update vulnerabilities guide to mention CVE-2025-68473 and CVE-2025-68474 2025-12-25 13:40:14 +08:00
Jin Cheng 4a49312321 fix(bt/bluedroid): cleaned the code according to the tool cppcheck 2025-12-16 17:37:14 +08:00
Jin Cheng 1c0c9c6fbd fix(bt/bluedroid): fixed possible OOB read in smp_br_data_received 2025-12-16 17:37:14 +08:00
Jin Cheng 4466f5dd85 fix(bt/bluedroid): drop connection when atttempting to disable encryption 2025-12-16 17:37:14 +08:00
Jin Cheng cb1f8d1e15 fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd 2025-12-16 17:37:14 +08:00
Jin Cheng e65ef0995a fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl 2025-12-16 17:37:14 +08:00
Jin Cheng e4b54ede65 fix(bt/bluedroid): fixed an OOB bug in bta_av_setconfig_rej 2025-12-16 17:37:14 +08:00
Jin Cheng 0f9b02dd95 fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 7a45769e25 fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 25b2c79269 fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete 2025-12-16 17:37:14 +08:00
Jin Cheng d4c96f070c fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 1a944a4bed fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 69b47952e8 fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute 2025-12-16 17:37:14 +08:00
Jin Cheng 6fe7456575 fix(bt/bluedroid): report failure when not able to connect to AVRCP 2025-12-16 17:37:14 +08:00
Jin Cheng 5ab93b428d fix(bt/bluedroid): fixed buffer overflow in BRSF 2025-12-16 17:37:14 +08:00
Jin Cheng 0638ae7177 fix(bt/bluedroid): added negative length check in process_service_search_rsp 2025-12-16 17:37:14 +08:00
Jin Cheng 7cca70cd0d fix(bt/bluedroid): fixed OOB read in SDP server continuation length 2025-12-16 17:37:14 +08:00
Jin Cheng 131a4764c8 fix(bt/bluedroid): added length check when copy AVDTP packet 2025-12-16 17:37:14 +08:00
Jin Cheng 1d8f84701c fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET 2025-12-16 17:37:14 +08:00
Jin Cheng de4339d9d1 fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item 2025-12-16 17:37:14 +08:00
Jin Cheng 439c5cc93d fix(bt/bluedroid): added boundary check when reading SDP attribute response packet 2025-12-16 17:37:14 +08:00
Jin Cheng af9d55e487 fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp 2025-12-16 17:37:13 +08:00
Jin Cheng 7706e8abbc fix(bt/bluedroid): fixed potential OOB read in the reporting handler 
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
 2025-12-16 17:37:13 +08:00
Jin Cheng 8a44bd422d fix(bt/bluedroid): fixed a potential overflow about the media payload offset 
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
 2025-12-16 17:37:13 +08:00
Jin Cheng c07ac874ec fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2025-12-16 17:37:13 +08:00
Jin Cheng 801504e152 fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2025-12-16 17:37:13 +08:00
Jin Cheng b898e65794 fix(bt/bluedroid): reject device with same address in legacy paring 2025-12-16 17:37:13 +08:00
Jin Cheng 49195d826f fix(bt/bluedroid): ignore AVCT commands that are too long 2025-12-16 17:37:13 +08:00
Jin Cheng 2c2162efdc fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2025-12-16 17:37:13 +08:00
Jin Cheng fa76f4f10a fix(bt/bluedroid): make sure SDP only start discovery once 2025-12-16 17:37:13 +08:00
Jin Cheng 86d9063aac fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2025-12-16 17:37:13 +08:00
Jin Cheng 9a22611e30 fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-16 17:37:13 +08:00
Jin Cheng 1a27ef6d32 fix(bt/blurdoird): enable bitpool snity checks 2025-12-16 17:37:13 +08:00
Jin Cheng 65cb0be70f fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf 2025-12-15 19:29:20 +08:00
Jin Cheng bdf9592803 docs: update vulnerabilities guide to mention CVE-2025-66409 2025-12-11 14:10:54 +08:00
Jin Cheng b607198192 fix(bt/controller): Fixed some controller bugs 
- Fixed Bluetooth hardware error of 'CHMAP_ERROR'
- Fixed encryption collision bug
 2025-11-12 14:27:16 +08:00
Jin Cheng 6ca6f422da fix(bt/blurdoird): fixed an OOB write in bta_dm_sdp_result 2025-11-06 18:57:55 +08:00
Jin Cheng 565fa98d0c fix(bt/bluedroid): fixed potential OOB in AVRCP vendor command composition 2025-10-14 11:55:47 +08:00
Jin Cheng 3fa9d23ad2 fix(bt/controller): fixed several controller bugs 2025-09-29 09:59:42 +08:00
Jin Cheng ac2be3a58e fix(bt/controller): fixed the sniff anchor point can be mismatch from central and peripheral 2025-09-28 11:33:25 +08:00
JinCheng 5a6193ae14 fix(bluedroid): removed the code relying on compiler-specific extension for FAM in union 2025-09-27 11:28:54 +08:00
JinCheng 075ed218ca fix(bt/bluedroid): fixed potential OOB in Bluedroid 2025-09-25 10:20:10 +08:00
JinCheng fb04218563 fix(bt/bluedroid): update the COD before enabling inquiry scan 2025-08-25 15:53:48 +08:00
JinCheng 88722d50d5 fix(bt/controller): fixed some controller bugs 2025-08-13 19:27:35 +08:00
JinCheng 81d7ce47db fix(bt/bluedroid): correct a description error in the GAP header file 2025-08-13 19:27:35 +08:00