fix(ble/bluedroid): fix parameter validation and initialization in BLE APIs

- Add parameter validation in esp_gap_ble_api, esp_gattc_api, esp_gatts_api
- Initialize API args to prevent undefined behavior
- Add host status checks in API functions
- Fix memory leak if bluedroid init failed

components/bt/host/bluedroid/api/esp_bluedroid_hci.c

@@ -81,6 +81,8 @@ void hci_host_send_packet(uint8_t *data, uint16_t len)
 #else /* BT_CONTROLLER_INCLUDED == TRUE */
     if (s_hci_driver_ops.send) {
         s_hci_driver_ops.send(data, len);
+    } else {
+        ESP_LOGE(LOG_TAG, "%s send function is not registered", __func__);
     }
 #endif /* BT_CONTROLLER_INCLUDED == TRUE */
 }

components/bt/host/bluedroid/api/esp_bt_main.c

@@ -52,6 +52,7 @@ esp_err_t esp_bluedroid_enable(void)
     msg.act = BTC_MAIN_ACT_ENABLE;
 
     if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) {
+        future_free(*future_p);
         LOG_ERROR("Bluedroid enable failed\n");
         return ESP_FAIL;
     }
@@ -163,6 +164,9 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
     ret = bluedroid_config_init(cfg);
     if (ret != BT_STATUS_SUCCESS) {
         LOG_ERROR("Bluedroid stack initialize fail, ret:%d", ret);
+#if HEAP_MEMORY_STATS
+        osi_mem_deinit();
+#endif
         return ESP_FAIL;
     }
 
@@ -172,6 +176,11 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
     ret = btc_init();
     if (ret != BT_STATUS_SUCCESS) {
         LOG_ERROR("Bluedroid Initialize Fail");
+        bluedroid_config_deinit();
+#if HEAP_MEMORY_STATS
+        osi_mem_deinit();
+#endif
+
         return ESP_FAIL;
     }
 
@@ -179,6 +188,12 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
     *future_p = future_new();
     if (*future_p == NULL) {
         LOG_ERROR("Bluedroid Initialize Fail!");
+        btc_deinit();
+        bluedroid_config_deinit();
+#if HEAP_MEMORY_STATS
+        osi_mem_deinit();
+#endif
+
         return ESP_ERR_NO_MEM;
     }
 
@@ -188,11 +203,22 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
 
     if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) {
         LOG_ERROR("Bluedroid Initialize Fail");
+        future_free(*future_p);
+        btc_deinit();
+        bluedroid_config_deinit();
+#if HEAP_MEMORY_STATS
+        osi_mem_deinit();
+#endif
         return ESP_FAIL;
     }
 
     if (future_await(*future_p) == FUTURE_FAIL) {
         LOG_ERROR("Bluedroid Initialize Fail");
+        btc_deinit();
+        bluedroid_config_deinit();
+#if HEAP_MEMORY_STATS
+        osi_mem_deinit();
+#endif
         return ESP_FAIL;
     }
 

components/bt/host/bluedroid/api/esp_gatt_common_api.c

@@ -25,6 +25,7 @@ esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)
 {
     btc_msg_t msg = {0};
     btc_ble_gatt_com_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -54,6 +55,9 @@ extern UINT16 L2CA_GetFreePktBufferNum_LE(void);
 
 uint16_t esp_ble_get_sendable_packets_num (void)
 {
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return 0;
+    }
     return L2CA_GetFreePktBufferNum_LE();
 }
 
@@ -70,6 +74,9 @@ uint16_t esp_ble_get_sendable_packets_num (void)
 extern UINT16 L2CA_GetCurFreePktBufferNum_LE(UINT16 conn_id);
 uint16_t esp_ble_get_cur_sendable_packets_num (uint16_t connid)
 {
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return 0;
+    }
     return L2CA_GetCurFreePktBufferNum_LE(connid);
 }
 #endif

components/bt/host/bluedroid/api/esp_gattc_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -31,6 +31,9 @@ esp_err_t esp_ble_gattc_register_callback(esp_gattc_cb_t callback)
 
 esp_gattc_cb_t esp_ble_gattc_get_callback(void)
 {
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return NULL;
+    }
     return (esp_gattc_cb_t) btc_profile_cb_get(BTC_PID_GATTC);
 }
 
@@ -38,6 +41,7 @@ esp_err_t esp_ble_gattc_app_register(uint16_t app_id)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -57,6 +61,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -72,6 +77,7 @@ esp_err_t esp_ble_gattc_enh_open(esp_gatt_if_t gattc_if, esp_ble_gatt_creat_conn
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
     const esp_ble_conn_params_t *conn_params;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -216,6 +222,7 @@ esp_err_t esp_ble_gattc_aux_open_with_pawr_synced(esp_gatt_if_t gattc_if, esp_bl
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
     const esp_ble_conn_params_t *conn_params;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -315,6 +322,7 @@ esp_err_t esp_ble_gattc_close (esp_gatt_if_t gattc_if, uint16_t conn_id)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -330,6 +338,7 @@ esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -345,6 +354,7 @@ esp_err_t esp_ble_gattc_search_service(esp_gatt_if_t gattc_if, uint16_t conn_id,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -386,15 +396,16 @@ esp_gatt_status_t esp_ble_gattc_get_all_char(esp_gatt_if_t gattc_if,
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if ((start_handle == 0) && (end_handle == 0)) {
-        *count = 0;
-        return ESP_GATT_INVALID_HANDLE;
-    }
 
     if (result == NULL || count == NULL || *count == 0) {
         return ESP_GATT_INVALID_PDU;
     }
 
+    if ((start_handle == 0) && (end_handle == 0)) {
+        *count = 0;
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
     return btc_ble_gattc_get_all_char(conn_hdl, start_handle, end_handle, result, count, offset);
 }
@@ -429,15 +440,15 @@ esp_gatt_status_t esp_ble_gattc_get_char_by_uuid(esp_gatt_if_t gattc_if,
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (result == NULL || count == NULL || *count == 0) {
+        return ESP_GATT_INVALID_PDU;
+    }
+
     if (start_handle == 0 && end_handle == 0) {
         *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
-    if (result == NULL || count == NULL || *count == 0) {
-        return ESP_GATT_INVALID_PDU;
-    }
-
     uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if,conn_id);
     return btc_ble_gattc_get_char_by_uuid(conn_hdl, start_handle, end_handle, char_uuid, result, count);
 }
@@ -471,15 +482,15 @@ esp_gatt_status_t esp_ble_gattc_get_descr_by_char_handle(esp_gatt_if_t gattc_if,
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (result == NULL || count == NULL || *count == 0) {
+        return ESP_GATT_INVALID_PDU;
+    }
+
     if (char_handle == 0) {
         *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
-    if (result == NULL || count == NULL || *count == 0) {
-        return ESP_GATT_INVALID_PDU;
-    }
-
     uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
     return btc_ble_gattc_get_descr_by_char_handle(conn_hdl, char_handle, descr_uuid, result, count);
 }
@@ -494,15 +505,15 @@ esp_gatt_status_t esp_ble_gattc_get_include_service(esp_gatt_if_t gattc_if,
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (result == NULL || count == NULL || *count == 0) {
+        return ESP_GATT_INVALID_PDU;
+    }
+
     if (start_handle == 0 && end_handle == 0) {
         *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
-    if (result == NULL || count == NULL || *count == 0) {
-        return ESP_GATT_INVALID_PDU;
-    }
-
     uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
     return btc_ble_gattc_get_include_service(conn_hdl, start_handle, end_handle, incl_uuid, result, count);
 }
@@ -517,15 +528,15 @@ esp_gatt_status_t esp_ble_gattc_get_attr_count(esp_gatt_if_t gattc_if,
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (count == NULL) {
+        return ESP_GATT_INVALID_PDU;
+    }
+
     if ((start_handle == 0 && end_handle == 0) && (type != ESP_GATT_DB_DESCRIPTOR)) {
         *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
-    if (count == NULL) {
-        return ESP_GATT_INVALID_PDU;
-    }
-
     uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
     return btc_ble_gattc_get_attr_count(conn_hdl, type, start_handle, end_handle, char_handle, count);
 }
@@ -535,15 +546,16 @@ esp_gatt_status_t esp_ble_gattc_get_db(esp_gatt_if_t gattc_if, uint16_t conn_id,
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (start_handle == 0 && end_handle == 0) {
-        *count = 0;
-        return ESP_GATT_INVALID_HANDLE;
-    }
 
     if (db == NULL || count == NULL || *count == 0) {
         return ESP_GATT_INVALID_PDU;
     }
 
+    if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
+        return ESP_GATT_INVALID_HANDLE;
+    }
+
     uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
     return btc_ble_gattc_get_db(conn_hdl, start_handle, end_handle, db, count);
 }
@@ -555,6 +567,7 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
     tGATT_TCB       *p_tcb = gatt_get_tcb_by_idx(conn_id);
@@ -591,6 +604,7 @@ esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -631,10 +645,11 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (read_multi == NULL) {
+    if ((read_multi == NULL) || (read_multi->num_attr == 0) || (read_multi->num_attr > ESP_GATT_MAX_READ_MULTI_HANDLES)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -656,12 +671,8 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
     arg.read_multiple.num_attr = read_multi->num_attr;
     arg.read_multiple.auth_req = auth_req;
 
-    if (read_multi->num_attr > 0) {
-        memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr);
-    } else {
-        LOG_ERROR("%s(), the num_attr should not be 0.", __func__);
-        return ESP_FAIL;
-    }
+    memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr);
+
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -671,10 +682,11 @@ esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (read_multi == NULL) {
+    if ((read_multi == NULL) || (read_multi->num_attr == 0) || (read_multi->num_attr > ESP_GATT_MAX_READ_MULTI_HANDLES)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -695,13 +707,8 @@ esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if,
     arg.read_multiple.conn_id = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
     arg.read_multiple.num_attr = read_multi->num_attr;
     arg.read_multiple.auth_req = auth_req;
+    memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr);
 
-    if (read_multi->num_attr > 0) {
-        memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr);
-    } else {
-        LOG_ERROR("%s(), the num_attr should not be 0.", __func__);
-        return ESP_FAIL;
-    }
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -711,6 +718,7 @@ esp_err_t esp_ble_gattc_read_char_descr (esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -748,9 +756,14 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if(value == NULL || value_len == 0) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     tGATT_TCB       *p_tcb = gatt_get_tcb_by_idx(conn_id);
     if (!gatt_check_connection_state_by_tcb(p_tcb)) {
         LOG_WARN("%s, The connection not created.", __func__);
@@ -791,6 +804,7 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -834,6 +848,7 @@ esp_err_t esp_ble_gattc_prepare_write(esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -875,6 +890,7 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -911,6 +927,7 @@ esp_err_t esp_ble_gattc_execute_write (esp_gatt_if_t gattc_if, uint16_t conn_id,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -928,6 +945,7 @@ esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -954,6 +972,7 @@ esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -978,6 +997,7 @@ esp_err_t esp_ble_gattc_cache_refresh(esp_bd_addr_t remote_bda)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -997,6 +1017,7 @@ esp_err_t esp_ble_gattc_cache_clean(esp_bd_addr_t remote_bda)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -1016,6 +1037,7 @@ esp_err_t esp_ble_gattc_cache_assoc(esp_gatt_if_t gattc_if, esp_bd_addr_t src_ad
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -1038,6 +1060,7 @@ esp_err_t esp_ble_gattc_cache_get_addr_list(esp_gatt_if_t gattc_if)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 

components/bt/host/bluedroid/api/esp_gatts_api.c

@@ -31,6 +31,9 @@ esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback)
 
 esp_gatts_cb_t esp_ble_gatts_get_callback(void)
 {
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return NULL;
+    }
     return (esp_gatts_cb_t) btc_profile_cb_get(BTC_PID_GATTS);
 }
 
@@ -38,6 +41,7 @@ esp_err_t esp_ble_gatts_app_register(uint16_t app_id)
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -59,6 +63,7 @@ esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if)
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -75,6 +80,7 @@ esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -99,6 +105,7 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -128,6 +135,7 @@ esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t i
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -147,6 +155,7 @@ esp_err_t esp_ble_gatts_add_char(uint16_t service_handle,  esp_bt_uuid_t  *char_
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
     esp_err_t status;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -191,6 +200,7 @@ esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
     esp_err_t status;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -231,6 +241,7 @@ esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle)
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -246,6 +257,7 @@ esp_err_t esp_ble_gatts_start_service(uint16_t service_handle)
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -261,6 +273,7 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle)
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -276,15 +289,20 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle)
 esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle,
                                       uint16_t value_len, uint8_t *value, bool need_confirm)
 {
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
     if (value_len > ESP_GATT_MAX_ATTR_LEN) {
         LOG_ERROR("%s, value_len > ESP_GATT_MAX_ATTR_LEN.", __func__);
         return ESP_ERR_INVALID_SIZE;
     }
 
+    if(value == NULL && value_len > 0) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
-    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     tGATT_TCB       *p_tcb = gatt_get_tcb_by_idx(conn_id);
     if (!gatt_check_connection_state_by_tcb(p_tcb)) {
@@ -317,6 +335,9 @@ esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id,
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
+
+   // rsp may be NULL
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -342,6 +363,11 @@ esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, co
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
+
+    if(value == NULL && length > 0) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -376,6 +402,7 @@ esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, b
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -398,6 +425,7 @@ esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -414,6 +442,7 @@ esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, e
 {
     btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
+    memset(&arg, 0, sizeof(arg));
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -2448,7 +2448,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_READ_LOCAL_SUPP_CAPS_EVT
      */
     struct ble_cs_read_local_supp_caps_evt {
-        uint8_t status;                          /*!< Indicate channel sounding read local supported capabilities command successfully completed */
+        esp_bt_status_t status;                  /*!< Indicate channel sounding read local supported capabilities command successfully completed */
         uint16_t conn_handle;                    /*!< Connection Handle */
         uint8_t num_config_supported;            /*!< Number of CS configurations supported per connection */
         uint16_t max_consecutive_proc_supported; /*!< 0x0000: Support for both a fixed number of consecutive CS procedures and for an indefinite number of CS procedures until termination
@@ -2515,7 +2515,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_READ_REMOTE_SUPP_CAPS_CMPL_EVT
      */
     struct ble_cs_read_remote_supp_caps {
-        uint8_t status;                          /*!< 0x00: Channel sounding read remote supported capabilities command successfully completed
+        esp_bt_status_t status;                  /*!< 0x00: Channel sounding read remote supported capabilities command successfully completed
                                                       other: Channel sounding read remote supported capabilities command failed */
         uint16_t conn_handle;                    /*!< Connection Handle */
         uint8_t num_config_supported;            /*!< Number of CS configurations supported per connection */
@@ -2578,7 +2578,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_SUPP_CAPS_EVT
      */
     struct ble_cs_write_cached_remote_supp_caps {
-        uint8_t status;         /*!< 0x00: Channel sounding write cached remote FAE table command succeeded
+        esp_bt_status_t status; /*!< 0x00: Channel sounding write cached remote FAE table command succeeded
                                      0x01: Channel sounding write cached remote FAE table command failed */
         uint16_t conn_handle;   /*!< Connection Handle */
     } cs_write_cached_remote_supp_caps; /*!< Event parameter of ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_SUPP_CAPS_EVT */
@@ -2586,7 +2586,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_SECURITY_ENABLE_CMPL_EVT
      */
     struct ble_cs_security_enable {
-        uint8_t status;         /*!< 0x00: Channel sounding security parameters successfully exchanged
+        esp_bt_status_t status; /*!< 0x00: Channel sounding security parameters successfully exchanged
                                                other: Channel sounding CS security parameter exchange failed */
         uint16_t conn_handle;   /*!< Connection Handle */
     } cs_security_enable; /*!< Event parameter of ESP_GAP_BLE_CS_SECURITY_ENABLE_CMPL_EVT */
@@ -2594,7 +2594,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_SET_DEFAULT_SETTINGS_EVT
      */
     struct ble_cs_set_default_settings {
-        uint8_t status;                 /*!< 0x00: Channel sounding set default settings command successfully completed
+        esp_bt_status_t status;         /*!< 0x00: Channel sounding set default settings command successfully completed
                                                other: Channel sounding set default settings command failed*/
         uint16_t conn_handle;           /*!< Connection Handle */
     } cs_set_default_settings; /*!< Event parameter of ESP_GAP_BLE_CS_SET_DEFAULT_SETTINGS_EVT */
@@ -2602,7 +2602,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_READ_REMOTE_FAE_TABLE_CMPL_EVT
      */
     struct ble_cs_read_remote_fae_tab {
-        uint8_t status;                   /*!< 0x00: Channel sounding read remote FAE Table command successfully completed
+        esp_bt_status_t status;           /*!< 0x00: Channel sounding read remote FAE Table command successfully completed
                                                other: Channel sounding read remote FAE Table command failed*/
         uint16_t conn_handle;             /*!< Connection Handle */
         uint8_t remote_fae_table[72];     /*!< Per-channel mode-0 Frequency Actuation Error table of the remote Controller */
@@ -2611,7 +2611,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_FAE_TABLE_EVT
      */
     struct ble_cs_write_cached_remote_fae_tab {
-        uint8_t status;                  /*!< 0x00: Channel sounding write cached remote FAE table command succeeded
+        esp_bt_status_t status;          /*!< 0x00: Channel sounding write cached remote FAE table command succeeded
                                               other: Channel sounding write cached remote FAE table command failed */
         uint16_t conn_handle;            /*!< Connection Handle */
     } cs_write_cached_remote_fae_tab; /*!< Event parameter of ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_FAE_TABLE_EVT */
@@ -2619,7 +2619,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_CONFIG_CMPL_EVT
      */
     struct ble_cs_config_udpate {
-        uint8_t status;               /*!< 0x00: Channel Sounding Configuration procedure succeeded
+        esp_bt_status_t status;       /*!< 0x00: Channel Sounding Configuration procedure succeeded
                                          other: Channel Sounding Configuration procedure failed */
         uint16_t conn_handle;         /*!< Connection Handle */
         uint8_t config_id;            /*!< CS configuration identifier */
@@ -2680,7 +2680,7 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_SET_PROC_PARAMS_CMPL_EVT
      */
     struct ble_cs_set_proc_params {
-        uint8_t status;         /*!< 0x00: Channel sounding set procedure_Parameters command successful
+        esp_bt_status_t status; /*!< 0x00: Channel sounding set procedure_Parameters command successful
                                      other: Channel sounding set procedure_Parameters command failed */
         uint16_t conn_handle;   /*!< Connection Handle */
     } cs_set_proc_params; /*!< Event parameter of ESP_GAP_BLE_CS_SET_PROC_PARAMS_CMPL_EVT */
@@ -2688,14 +2688,14 @@ typedef union {
      * @brief ESP_GAP_BLE_CS_SET_CHANNEL_CLASS_CMPL_EVT
      */
     struct ble_cs_set_channel_class {
-        uint8_t status;        /*!< 0x00: Channel sounding set channel classification command successful
+        esp_bt_status_t status; /*!< 0x00: Channel sounding set channel classification command successful
                                     other: Channel sounding set channel classification command failed */
     } cs_set_channel_class; /*!< Event parameter of ESP_GAP_BLE_CS_SET_CHANNEL_CLASS_CMPL_EVT */
     /**
      * @brief ESP_GAP_BLE_CS_PROC_ENABLE_CMPL_EVT
      */
     struct ble_cs_proc_enable {
-        uint8_t status;                 /*!< 0x00: Channel sounding procedure enable command successful
+        esp_bt_status_t status;         /*!< 0x00: Channel sounding procedure enable command successful
                                             other: Channel sounding procedure enable command failed */
         uint16_t conn_handle;           /*!< Connection Handle */
         uint8_t config_id;              /*!< CS configuration identifier */