Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity
45,699 Commits 25 Branches 192 Tags
df3df94c58d58ecce2e152c1ef49f5ef8a2d4e49
Commit Graph

45699 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tomáš Rohlínek
df3df94c58 fix(storage/fatfs): reject empty exFAT cluster heap (CVE-2026-6683) 
CVE-2026-6683 is an exFAT divide-by-zero: with NumClusters == 0 the filesystem
object has fs->n_fatent == 2, and the exFAT "percent in use" update in sync_fs()
computes ... * 100 / (fs->n_fatent - 2) -> division by zero.

That vulnerable exFAT PercInUse sync path was introduced in FatFs R0.16 and is
NOT present in this R0.15 release, so the divide-by-zero itself is not reachable
here. As defense-in-depth (and to keep parity with newer releases) reject an
empty exFAT cluster heap at mount time, which is a malformed volume regardless.

Record the CVE disposition in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/
 2026-07-22 20:34:55 +08:00
Tomáš Rohlínek
b5c012dc19 fix(storage/fatfs): fix exFAT mount integer overflow (CVE-2026-6682) 
The exFAT mount path validates that the media is large enough to hold the
declared cluster heap with:

    if (maxlba < (QWORD)fs->database + ncl * fs->csize) ...

`ncl` (DWORD, up to MAX_EXFAT) and `fs->csize` (WORD) are both promoted to
`unsigned int`, so `ncl * fs->csize` is evaluated in 32-bit arithmetic and can
wrap before the QWORD promotion of the sum. A crafted image with a large
NumClusters/SecPerClus can therefore make an undersized volume pass the "size
is large enough" check; subsequent cluster->sector math then addresses media
outside the actual device.

Promote the multiply to 64-bit ((QWORD)ncl * fs->csize). Apply the same
promotion to the bitmap-base computation ((LBA_t)fs->csize * (bcl - 2)), which
has the identical overflow shape. Record the CVE in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/
 2026-07-22 20:34:55 +08:00
morris
2b49bba8a8 Merge branch 'feat/i2s_duplex_update_v5.4' into 'release/v5.4' 
feat(i2s): allow full duplex mode in less strict condition (v5.4)

See merge request espressif/esp-idf!50868
 2026-07-22 18:26:50 +08:00
Wang Meng Yang
6fa5210202 Merge branch 'bugfix/idf_ci_example_avrcp_v5.4' into 'release/v5.4' 
fix(bt/example): Add log in the failure path for avrcp_ct_metadata example (v5.4)

See merge request espressif/esp-idf!51061
 2026-07-22 16:05:13 +08:00
yangfeng
66e234ebed fix(bt/example): Add log in the failure path for avrcp_ct_metadata example 2026-07-22 15:36:43 +08:00
Wang Meng Yang
4d44115e31 Merge branch 'bugfix/hid_host_oob_read_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act (v5.4)

See merge request espressif/esp-idf!50974
 2026-07-22 14:10:28 +08:00
Island
472d73d74c Merge branch 'fix/ble-log-store-access-fault_v5.4' into 'release/v5.4' 
fix: Ensure BLE Log Global Variables in Internal RAM (5.4)

See merge request espressif/esp-idf!51034
 2026-07-22 14:02:47 +08:00
Mahavir Jain
19c8b065db Merge branch 'feat/mbedtls_update_3.6.7_v5.4' into 'release/v5.4' 
feat(mbedtls): update to version 3.6.7 (v5.4)

See merge request espressif/esp-idf!50658
 2026-07-22 09:38:55 +05:30
Martin Vychodil
97801546aa Merge branch 'fix/sdmmc_cmd_err_switch_case_handling_v5.4' into 'release/v5.4' 
fix(sdmmc): sdmmc_cmd.c fixed error handling in certain if and switch statements (v5.4)

See merge request espressif/esp-idf!50685
 2026-07-21 20:55:46 +08:00
Zhou Xiao
e6f43ca6c6 fix(bt): keep BLE log ISR state in internal RAM 
(cherry picked from commit 2fa434eb50)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
 2026-07-21 19:44:14 +08:00
Euripedes Rocha
9f2a5a51ff Merge branch 'fix/sec-1137-br-glue-double-free_v5.4' into 'release/v5.4' 
fix(esp_netif): harden br_glue instance-handler cleanup against double-free (SEC-1137) (v5.4)

See merge request espressif/esp-idf!50645
 2026-07-21 10:41:53 +02:00
Ashish Sharma
cfae960f2e feat(mbedtls): add option to choose constant-time prime generation 2026-07-21 16:03:27 +08:00
Ashish Sharma
1646e69781 feat(mbedtls): update to version 3.6.7 2026-07-21 15:47:46 +08:00
Wang Meng Yang
a8134b4456 Merge branch 'bugfix/a2dp_sbc_v5.4' into 'release/v5.4' 
fix(bt): Fix the pointer sbc_start_frame is not initialized(v5.4)

See merge request espressif/esp-idf!50958
 2026-07-21 13:36:43 +08:00
Chen Chen
2f9d144cbe refactor(i2s): make the slot_bit_width checks unique 2026-07-21 11:09:53 +08:00
morris
fd011d7d7e Merge branch 'fix/fix_i2s_i80_color_size_check_v5.4' into 'release/v5.4' 
fix(lcd): add color size check for i80 and boundary check for rgb (v5.4)

See merge request espressif/esp-idf!50966
 2026-07-21 10:26:13 +08:00
Island
1d545e6618 Merge branch 'feat/ble_log_compression_module_cfg_update_v5.4' into 'release/v5.4' 
Feat/ble log compression module cfg update (5.4)

See merge request espressif/esp-idf!49873
 2026-07-20 21:37:56 +08:00
Chen Jichang
9f68a52bd3 fix(lcd): add color size check for i80 and boundary check for rgb 2026-07-20 17:42:46 +08:00
Alexey Gerenkov
a65b5216c6 Merge branch 'feature/update-openocd-to-v0.12.0-esp32-20260703_v5.4' into 'release/v5.4' 
feat(tools): update openocd version to v0.12.0-esp32-20260703 (v5.4)

See merge request espressif/esp-idf!50505
 2026-07-20 17:20:29 +08:00
Alexey Gerenkov
166e2a075e Merge branch 'fix/lp_core_noreset_under_debug_option_v5.4' into 'release/v5.4' 
fix(lp_core): fix build for CONFIG_ULP_NORESET_UNDER_DEBUG=n (v5.4)

See merge request espressif/esp-idf!49870
 2026-07-20 17:11:03 +08:00
Jin Cheng
888cd3cfa9 fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act 
Closes SEC-786
 2026-07-20 16:38:11 +08:00
morris
434942d91d Merge branch 'fix/fix_image_header_check_v5.4' into 'release/v5.4' 
image header: fixed image header segment count check (v5.4)

See merge request espressif/esp-idf!50937
 2026-07-20 15:34:36 +08:00
Jiang Jiang Jian
ecbdbf98b5 Merge branch 'fix/blacklist_flag_correction_v5.4' into 'release/v5.4' 
fix(wifi): Correct blacklist flag(v5.4)

See merge request espressif/esp-idf!50921
 2026-07-20 15:22:58 +08:00
morris
d658372e4a Merge branch 'fix/adc_clk_div_error_v5.4' into 'release/v5.4' 
Fix ADC continuous sample frequency and clock divide error on H2/C5/C61 (v5.4)

See merge request espressif/esp-idf!47977
 2026-07-20 15:08:12 +08:00
yangfeng
e9f0ec091b fix(bt): Fix the pointer sbc_start_frame is not initialized 
- Closes https://github.com/espressif/esp-idf/issues/18835
 2026-07-20 15:01:42 +08:00
morris
24a1100642 Merge branch 'fix/adc_monitor_error_on_ch8_9_on_s3_v5.4' into 'release/v5.4' 
Fix ADC Continuous Monitor Callback Failure for ADC1 Channels 8/9 on ESP32-S3 (v5.4)

See merge request espressif/esp-idf!49507
 2026-07-20 14:34:19 +08:00
Marius Vikhammer
31035f28bf Merge branch 'fix/lp_periph_init_fail_with_cpp_v5.4' into 'release/v5.4' 
fix(ulp): make LP peripheral default config macros C++ compatible (v5.4)

See merge request espressif/esp-idf!50213
 2026-07-20 13:54:11 +08:00
Jiang Jiang Jian
1e96e00456 Merge branch 'bugfix/avrc_ca_attr_id_check_v5.4' into 'release/v5.4' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v5.4)

See merge request espressif/esp-idf!50552
 2026-07-20 11:36:03 +08:00
Jiang Jiang Jian
e69913d969 Merge branch 'fix/allow_task_and_coredump_mem_in_spm_v5.4' into 'release/v5.4' 
fix(esp_hw_support): update memory pointer checks for SPM support (v5.4)

See merge request espressif/esp-idf!50631
 2026-07-20 11:35:48 +08:00
gaoxu
90f4cdc2dd fix(adc): fix ESP32-H2/C5/C61 clock divide error 2026-07-20 11:04:32 +08:00
gaoxu
5def8cf653 ci(adc): add adc continuous sample frequency test 2026-07-20 11:04:32 +08:00
morris
58ed70f7ee Merge branch 'fix/wrong_channel_gpio_num_on_p4_adc2_v5.4' into 'release/v5.4' 
ADC: add continuous parse data API (v5.4)

See merge request espressif/esp-idf!42206
 2026-07-20 10:33:05 +08:00
Armando (Dou Yiwen)
c3d376055f fix: fixed image header segment count check 
Signed-off-by: Armando (Dou Yiwen) <douyiwen@espressif.com>
 2026-07-20 10:25:15 +08:00
morris
515a532893 Merge branch 'fix/uart_is_enable_check_error_on_s3_v5.4' into 'release/v5.4' 
Fix ESP32-S3 uart2 is_enabled check error (v5.4)

See merge request espressif/esp-idf!49350
 2026-07-20 10:02:22 +08:00
gaoxu
06d3a706f9 fix(adc): fix ADC monitor channel 8/9 error 
(Closes https://github.com/espressif/esp-idf/issues/17768)
 2026-07-19 17:10:23 +08:00
Wang Meng Yang
591ea73bfb Merge branch 'bugfix/bug_bounty_av_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v5.4)

See merge request espressif/esp-idf!50479
 2026-07-19 10:25:16 +08:00
Wang Meng Yang
a2e4ad5602 Merge branch 'bugfix/fix_bredr_inq_crash_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v5.4)

See merge request espressif/esp-idf!50856
 2026-07-19 10:06:49 +08:00
Rahul Tank
3e8147983c Merge branch 'bugfix/add_dis_ieee_udi_to_config_v5.4' into 'release/v5.4' 
fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v5.4)

See merge request espressif/esp-idf!50762
 2026-07-18 09:31:48 +05:30
yangfeng
6c7135e869 fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-17 20:11:41 +08:00
Wang Meng Yang
8063006d12 Merge branch 'bugfix/smp_sec_flags_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v5.4)

See merge request espressif/esp-idf!50568
 2026-07-17 20:10:02 +08:00
tarun.kumar
177bb8fe94 fix(wifi): Correct blacklist flag 2026-07-17 17:38:21 +05:30
Wang Meng Yang
bd2d240186 Merge branch 'bugfix/idf_ci_hid_example_v5.4' into 'release/v5.4' 
fix(bt/example): Add print the device name to verify if it matches in HID example (v5.4)

See merge request espressif/esp-idf!50485
 2026-07-17 20:03:39 +08:00
Sumeet Singh
6885c7946c fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v5.4) 2026-07-17 14:59:05 +05:30
Chen Chen
7728baf052 feat(i2s): allow full duplex mode in less strict condition 2026-07-17 14:40:28 +08:00
Rahul Tank
fbd0210bf1 Merge branch 'bugfix/add_extra_prints_v5.4' into 'release/v5.4' 
fix(nimble): Remove SOC_ESP_NIMBLE_CONTROLLER from unnecessary locations (v5.4)

See merge request espressif/esp-idf!50097
 2026-07-17 10:42:35 +05:30
linruihao
1c2eb36135 fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:30 +08:00
luoxu
80554da58c feat(ble): reorganize log compression Kconfig 
Move log-compression Kconfig files to host/ and profile/mesh/ directories and update source paths.
 2026-07-16 21:52:52 +08:00
Rahul Tank
82ae7e7f76 fix(nimble): Fix ECC HW byte-order and dropped SOC_ESP_NIMBLE_CONTROLLER 2026-07-16 16:39:52 +05:30
luoxu
0046fae26c feat(ble): split log compression Kconfig into separate mesh and host files 2026-07-16 11:50:02 +08:00
Luo Xu
638b809b78 fix(ble): fix Bluedroid log compression for newly added modules 
(cherry picked from commit 8d4f1cb608)

Co-authored-by: luoxu <luoxu@espressif.com>
 2026-07-16 11:50:02 +08:00