Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity
45,699 Commits 25 Branches 192 Tags
df3df94c58d58ecce2e152c1ef49f5ef8a2d4e49
Commit Graph

31566 Commits

Author SHA1 Message Date
Tomáš Rohlínek
df3df94c58 fix(storage/fatfs): reject empty exFAT cluster heap (CVE-2026-6683) 
CVE-2026-6683 is an exFAT divide-by-zero: with NumClusters == 0 the filesystem
object has fs->n_fatent == 2, and the exFAT "percent in use" update in sync_fs()
computes ... * 100 / (fs->n_fatent - 2) -> division by zero.

That vulnerable exFAT PercInUse sync path was introduced in FatFs R0.16 and is
NOT present in this R0.15 release, so the divide-by-zero itself is not reachable
here. As defense-in-depth (and to keep parity with newer releases) reject an
empty exFAT cluster heap at mount time, which is a malformed volume regardless.

Record the CVE disposition in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/
 2026-07-22 20:34:55 +08:00
Tomáš Rohlínek
b5c012dc19 fix(storage/fatfs): fix exFAT mount integer overflow (CVE-2026-6682) 
The exFAT mount path validates that the media is large enough to hold the
declared cluster heap with:

    if (maxlba < (QWORD)fs->database + ncl * fs->csize) ...

`ncl` (DWORD, up to MAX_EXFAT) and `fs->csize` (WORD) are both promoted to
`unsigned int`, so `ncl * fs->csize` is evaluated in 32-bit arithmetic and can
wrap before the QWORD promotion of the sum. A crafted image with a large
NumClusters/SecPerClus can therefore make an undersized volume pass the "size
is large enough" check; subsequent cluster->sector math then addresses media
outside the actual device.

Promote the multiply to 64-bit ((QWORD)ncl * fs->csize). Apply the same
promotion to the bitmap-base computation ((LBA_t)fs->csize * (bcl - 2)), which
has the identical overflow shape. Record the CVE in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/
 2026-07-22 20:34:55 +08:00
morris
2b49bba8a8 Merge branch 'feat/i2s_duplex_update_v5.4' into 'release/v5.4' 
feat(i2s): allow full duplex mode in less strict condition (v5.4)

See merge request espressif/esp-idf!50868
 2026-07-22 18:26:50 +08:00
Wang Meng Yang
4d44115e31 Merge branch 'bugfix/hid_host_oob_read_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act (v5.4)

See merge request espressif/esp-idf!50974
 2026-07-22 14:10:28 +08:00
Island
472d73d74c Merge branch 'fix/ble-log-store-access-fault_v5.4' into 'release/v5.4' 
fix: Ensure BLE Log Global Variables in Internal RAM (5.4)

See merge request espressif/esp-idf!51034
 2026-07-22 14:02:47 +08:00
Mahavir Jain
19c8b065db Merge branch 'feat/mbedtls_update_3.6.7_v5.4' into 'release/v5.4' 
feat(mbedtls): update to version 3.6.7 (v5.4)

See merge request espressif/esp-idf!50658
 2026-07-22 09:38:55 +05:30
Martin Vychodil
97801546aa Merge branch 'fix/sdmmc_cmd_err_switch_case_handling_v5.4' into 'release/v5.4' 
fix(sdmmc): sdmmc_cmd.c fixed error handling in certain if and switch statements (v5.4)

See merge request espressif/esp-idf!50685
 2026-07-21 20:55:46 +08:00
Zhou Xiao
e6f43ca6c6 fix(bt): keep BLE log ISR state in internal RAM 
(cherry picked from commit 2fa434eb50)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
 2026-07-21 19:44:14 +08:00
Euripedes Rocha
9f2a5a51ff Merge branch 'fix/sec-1137-br-glue-double-free_v5.4' into 'release/v5.4' 
fix(esp_netif): harden br_glue instance-handler cleanup against double-free (SEC-1137) (v5.4)

See merge request espressif/esp-idf!50645
 2026-07-21 10:41:53 +02:00
Ashish Sharma
cfae960f2e feat(mbedtls): add option to choose constant-time prime generation 2026-07-21 16:03:27 +08:00
Ashish Sharma
1646e69781 feat(mbedtls): update to version 3.6.7 2026-07-21 15:47:46 +08:00
Wang Meng Yang
a8134b4456 Merge branch 'bugfix/a2dp_sbc_v5.4' into 'release/v5.4' 
fix(bt): Fix the pointer sbc_start_frame is not initialized(v5.4)

See merge request espressif/esp-idf!50958
 2026-07-21 13:36:43 +08:00
Chen Chen
2f9d144cbe refactor(i2s): make the slot_bit_width checks unique 2026-07-21 11:09:53 +08:00
morris
fd011d7d7e Merge branch 'fix/fix_i2s_i80_color_size_check_v5.4' into 'release/v5.4' 
fix(lcd): add color size check for i80 and boundary check for rgb (v5.4)

See merge request espressif/esp-idf!50966
 2026-07-21 10:26:13 +08:00
Island
1d545e6618 Merge branch 'feat/ble_log_compression_module_cfg_update_v5.4' into 'release/v5.4' 
Feat/ble log compression module cfg update (5.4)

See merge request espressif/esp-idf!49873
 2026-07-20 21:37:56 +08:00
Chen Jichang
9f68a52bd3 fix(lcd): add color size check for i80 and boundary check for rgb 2026-07-20 17:42:46 +08:00
Alexey Gerenkov
166e2a075e Merge branch 'fix/lp_core_noreset_under_debug_option_v5.4' into 'release/v5.4' 
fix(lp_core): fix build for CONFIG_ULP_NORESET_UNDER_DEBUG=n (v5.4)

See merge request espressif/esp-idf!49870
 2026-07-20 17:11:03 +08:00
Jin Cheng
888cd3cfa9 fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act 
Closes SEC-786
 2026-07-20 16:38:11 +08:00
morris
434942d91d Merge branch 'fix/fix_image_header_check_v5.4' into 'release/v5.4' 
image header: fixed image header segment count check (v5.4)

See merge request espressif/esp-idf!50937
 2026-07-20 15:34:36 +08:00
Jiang Jiang Jian
ecbdbf98b5 Merge branch 'fix/blacklist_flag_correction_v5.4' into 'release/v5.4' 
fix(wifi): Correct blacklist flag(v5.4)

See merge request espressif/esp-idf!50921
 2026-07-20 15:22:58 +08:00
morris
d658372e4a Merge branch 'fix/adc_clk_div_error_v5.4' into 'release/v5.4' 
Fix ADC continuous sample frequency and clock divide error on H2/C5/C61 (v5.4)

See merge request espressif/esp-idf!47977
 2026-07-20 15:08:12 +08:00
yangfeng
e9f0ec091b fix(bt): Fix the pointer sbc_start_frame is not initialized 
- Closes https://github.com/espressif/esp-idf/issues/18835
 2026-07-20 15:01:42 +08:00
morris
24a1100642 Merge branch 'fix/adc_monitor_error_on_ch8_9_on_s3_v5.4' into 'release/v5.4' 
Fix ADC Continuous Monitor Callback Failure for ADC1 Channels 8/9 on ESP32-S3 (v5.4)

See merge request espressif/esp-idf!49507
 2026-07-20 14:34:19 +08:00
Marius Vikhammer
31035f28bf Merge branch 'fix/lp_periph_init_fail_with_cpp_v5.4' into 'release/v5.4' 
fix(ulp): make LP peripheral default config macros C++ compatible (v5.4)

See merge request espressif/esp-idf!50213
 2026-07-20 13:54:11 +08:00
Jiang Jiang Jian
1e96e00456 Merge branch 'bugfix/avrc_ca_attr_id_check_v5.4' into 'release/v5.4' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v5.4)

See merge request espressif/esp-idf!50552
 2026-07-20 11:36:03 +08:00
Jiang Jiang Jian
e69913d969 Merge branch 'fix/allow_task_and_coredump_mem_in_spm_v5.4' into 'release/v5.4' 
fix(esp_hw_support): update memory pointer checks for SPM support (v5.4)

See merge request espressif/esp-idf!50631
 2026-07-20 11:35:48 +08:00
gaoxu
90f4cdc2dd fix(adc): fix ESP32-H2/C5/C61 clock divide error 2026-07-20 11:04:32 +08:00
gaoxu
5def8cf653 ci(adc): add adc continuous sample frequency test 2026-07-20 11:04:32 +08:00
morris
58ed70f7ee Merge branch 'fix/wrong_channel_gpio_num_on_p4_adc2_v5.4' into 'release/v5.4' 
ADC: add continuous parse data API (v5.4)

See merge request espressif/esp-idf!42206
 2026-07-20 10:33:05 +08:00
Armando (Dou Yiwen)
c3d376055f fix: fixed image header segment count check 
Signed-off-by: Armando (Dou Yiwen) <douyiwen@espressif.com>
 2026-07-20 10:25:15 +08:00
morris
515a532893 Merge branch 'fix/uart_is_enable_check_error_on_s3_v5.4' into 'release/v5.4' 
Fix ESP32-S3 uart2 is_enabled check error (v5.4)

See merge request espressif/esp-idf!49350
 2026-07-20 10:02:22 +08:00
gaoxu
06d3a706f9 fix(adc): fix ADC monitor channel 8/9 error 
(Closes https://github.com/espressif/esp-idf/issues/17768)
 2026-07-19 17:10:23 +08:00
Wang Meng Yang
591ea73bfb Merge branch 'bugfix/bug_bounty_av_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v5.4)

See merge request espressif/esp-idf!50479
 2026-07-19 10:25:16 +08:00
Wang Meng Yang
a2e4ad5602 Merge branch 'bugfix/fix_bredr_inq_crash_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v5.4)

See merge request espressif/esp-idf!50856
 2026-07-19 10:06:49 +08:00
Rahul Tank
3e8147983c Merge branch 'bugfix/add_dis_ieee_udi_to_config_v5.4' into 'release/v5.4' 
fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v5.4)

See merge request espressif/esp-idf!50762
 2026-07-18 09:31:48 +05:30
yangfeng
6c7135e869 fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-17 20:11:41 +08:00
Wang Meng Yang
8063006d12 Merge branch 'bugfix/smp_sec_flags_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v5.4)

See merge request espressif/esp-idf!50568
 2026-07-17 20:10:02 +08:00
tarun.kumar
177bb8fe94 fix(wifi): Correct blacklist flag 2026-07-17 17:38:21 +05:30
Sumeet Singh
6885c7946c fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v5.4) 2026-07-17 14:59:05 +05:30
Chen Chen
7728baf052 feat(i2s): allow full duplex mode in less strict condition 2026-07-17 14:40:28 +08:00
linruihao
1c2eb36135 fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:30 +08:00
luoxu
80554da58c feat(ble): reorganize log compression Kconfig 
Move log-compression Kconfig files to host/ and profile/mesh/ directories and update source paths.
 2026-07-16 21:52:52 +08:00
Rahul Tank
82ae7e7f76 fix(nimble): Fix ECC HW byte-order and dropped SOC_ESP_NIMBLE_CONTROLLER 2026-07-16 16:39:52 +05:30
luoxu
0046fae26c feat(ble): split log compression Kconfig into separate mesh and host files 2026-07-16 11:50:02 +08:00
Luo Xu
638b809b78 fix(ble): fix Bluedroid log compression for newly added modules 
(cherry picked from commit 8d4f1cb608)

Co-authored-by: luoxu <luoxu@espressif.com>
 2026-07-16 11:50:02 +08:00
Euripedes Rocha
8b7f8045a6 Merge branch 'fix/lwip_sec_high_v5.4' into 'release/v5.4' 
fix(lwip): high severity lwip fixes (v5.4)

See merge request espressif/esp-idf!50595
 2026-07-15 15:31:35 +02:00
Martin Vychodil
dd7e09705a Merge branch 'fix/cleanup_after_failed_nvs_set_blob_v5.4' into 'release/v5.4' 
Fixed cleanup after nvs_set_blob failed on ESP_ERR_NVS_NOT_ENOUGH_SPACE (v5.4)

See merge request espressif/esp-idf!50745
 2026-07-15 18:39:36 +08:00
Marius Vikhammer
e1634cde52 Merge branch 'fix/esp32p4_panic_gdbstub_v5.4' into 'release/v5.4' 
fix(gdbstub): remove unsupported options in qSupported packet (v5.4)

See merge request espressif/esp-idf!50209
 2026-07-15 17:49:49 +08:00
Island
a1f767668c Merge branch 'bugfix/fix_bluedroid_read_multi_v5.4' into 'release/v5.4' 
fix(ble/bluedroid): fix GATT Read Multiple response handling (5.4)

See merge request espressif/esp-idf!50707
 2026-07-15 15:38:55 +08:00
Island
025b2f0984 Merge branch 'feat/support_bluedroid_le_coc_and_eatt_v5.4' into 'release/v5.4' 
feat(ble/bluedroid): Support bluedroid LE COC and EATT features (5.4)

See merge request espressif/esp-idf!50713
 2026-07-15 14:02:53 +08:00