Jin Cheng
cb1f8d1e15
fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd
2025-12-16 17:37:14 +08:00
Jin Cheng
e65ef0995a
fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl
2025-12-16 17:37:14 +08:00
Jin Cheng
e4b54ede65
fix(bt/bluedroid): fixed an OOB bug in bta_av_setconfig_rej
2025-12-16 17:37:14 +08:00
Jin Cheng
0f9b02dd95
fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete
2025-12-16 17:37:14 +08:00
Jin Cheng
7a45769e25
fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete
2025-12-16 17:37:14 +08:00
Jin Cheng
25b2c79269
fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete
2025-12-16 17:37:14 +08:00
Jin Cheng
d4c96f070c
fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete
2025-12-16 17:37:14 +08:00
Jin Cheng
1a944a4bed
fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete
2025-12-16 17:37:14 +08:00
Jin Cheng
69b47952e8
fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute
2025-12-16 17:37:14 +08:00
Jin Cheng
6fe7456575
fix(bt/bluedroid): report failure when not able to connect to AVRCP
2025-12-16 17:37:14 +08:00
Jin Cheng
5ab93b428d
fix(bt/bluedroid): fixed buffer overflow in BRSF
2025-12-16 17:37:14 +08:00
Jin Cheng
0638ae7177
fix(bt/bluedroid): added negative length check in process_service_search_rsp
2025-12-16 17:37:14 +08:00
Jin Cheng
7cca70cd0d
fix(bt/bluedroid): fixed OOB read in SDP server continuation length
2025-12-16 17:37:14 +08:00
Jin Cheng
131a4764c8
fix(bt/bluedroid): added length check when copy AVDTP packet
2025-12-16 17:37:14 +08:00
Jin Cheng
1d8f84701c
fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET
2025-12-16 17:37:14 +08:00
Jin Cheng
de4339d9d1
fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item
2025-12-16 17:37:14 +08:00
Jin Cheng
439c5cc93d
fix(bt/bluedroid): added boundary check when reading SDP attribute response packet
2025-12-16 17:37:14 +08:00
Jin Cheng
af9d55e487
fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp
2025-12-16 17:37:13 +08:00
Jin Cheng
7706e8abbc
fix(bt/bluedroid): fixed potential OOB read in the reporting handler
...
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-16 17:37:13 +08:00
Jin Cheng
8a44bd422d
fix(bt/bluedroid): fixed a potential overflow about the media payload offset
...
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-16 17:37:13 +08:00
Jin Cheng
c07ac874ec
fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open
2025-12-16 17:37:13 +08:00
Jin Cheng
801504e152
fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected
2025-12-16 17:37:13 +08:00
Jin Cheng
b898e65794
fix(bt/bluedroid): reject device with same address in legacy paring
2025-12-16 17:37:13 +08:00
Jin Cheng
49195d826f
fix(bt/bluedroid): ignore AVCT commands that are too long
2025-12-16 17:37:13 +08:00
Jin Cheng
2c2162efdc
fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP
2025-12-16 17:37:13 +08:00
Jin Cheng
fa76f4f10a
fix(bt/bluedroid): make sure SDP only start discovery once
2025-12-16 17:37:13 +08:00
Jin Cheng
86d9063aac
fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write
2025-12-16 17:37:13 +08:00
Jin Cheng
9a22611e30
fix(bt/blurdoird): check Classic key before cross-key derivation
2025-12-16 17:37:13 +08:00
Jin Cheng
1a27ef6d32
fix(bt/blurdoird): enable bitpool snity checks
2025-12-16 17:37:13 +08:00
Rahul Tank
f530984c90
fix(nimble): Add missing header file to fix compilation issue
2025-12-16 12:14:49 +05:30
Armando (Dou Yiwen)
5436ae6e69
Merge branch 'feature/update_esp32c5_eco3_rom_ld' into 'master'
...
feature(esp_rom): add esp32c5 eco3 rom ld
See merge request espressif/esp-idf!43543
2025-12-16 06:37:10 +00:00
morris
1f04dbb31b
Merge branch 'refactor/remove_completed_todos' into 'master'
...
refactor(global): remove completed todos in the codebase
See merge request espressif/esp-idf!44188
2025-12-16 14:21:25 +08:00
nilesh.kale
ef05ff039e
fix(docs): alter the warning sequence for structs
2025-12-16 11:48:06 +05:30
nilesh.kale
2267558b15
feat: enabled ECDSA peripheral support for ESSP32-P4
2025-12-16 11:48:06 +05:30
nilesh.kale
361ab5d0c7
fix(hal/test_apps): moved key manager tests under flash encryption check
...
These two tests executed when FPGA setup is there and pass only when
flash encryption is switched on. So, this tests been moved under FE check.
2025-12-16 11:48:06 +05:30
Jiang Jiang Jian
cbcc2ded3e
Merge branch 'bugfix/fix_vendor_ie_issue' into 'master'
...
fix(wifi): fixed the vendor ie length issue
Closes WIFIBUG-1622 and WIFIBUG-1623
See merge request espressif/esp-idf!44084
2025-12-16 14:06:52 +08:00
Rahul Tank
47552ff4fd
fix(protocomm): Add security checks for buffer overflow and incorrect length handling
2025-12-16 10:16:05 +05:30
Alexey Lapshin
2b94daf17f
fix(esp_rom): use hmac_md5 and hmac_md5_vector from ROM only if CONFIG_LIBC_NEWLIB
2025-12-16 11:35:47 +07:00
harshal.patil
bf16835aa1
test(mbedtls): Run mbedtls HW tests only if HW enabled
2025-12-16 10:05:25 +05:30
Chen Jichang
6ff2ff2c6c
fix(soc): update breakpoint nums on c5 and h4
2025-12-16 12:10:56 +08:00
liuning
eb882fa0eb
fix(coex): fix esp32 coex crash issue (7260f71)
2025-12-16 12:04:28 +08:00
Alexey Lapshin
141d3a1653
Merge branch 'fix/signal_h_pthread_declarations' into 'master'
...
fix(esp_libc): add workaround for pthread_sigmask declaration in picolibc signal.h
See merge request espressif/esp-idf!44246
2025-12-16 07:56:40 +04:00
Wang Meng Yang
5104528c52
Merge branch 'bugfix/l2c_fcr_clone_buf' into 'master'
...
fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf
See merge request espressif/esp-idf!44244
2025-12-16 11:50:59 +08:00
zhangyanjiao
e93e827185
fix(wifi): fixed the vendor ie length issue
2025-12-16 11:22:33 +08:00
C.S.M
082219cf77
Merge branch 'fix/jpeg_com_marker_check' into 'master'
...
feat(jpeg_decoder): Add decode to yuv420 since esp32p4 version3
Closes IDF-14896
See merge request espressif/esp-idf!44221
2025-12-16 10:58:52 +08:00
Wan Lei
62502fbd1c
Merge branch 'fix/fix_spi_master_tests' into 'master'
...
fix(driver_spi): fix some master test apps
Closes IDF-7503 and IDFCI-2820
See merge request espressif/esp-idf!44234
2025-12-16 10:33:02 +08:00
Alexey Lapshin
5d38af9c17
fix(esp_libc): add workaround for pthread_sigmask declaration in picolibc signal.h
2025-12-16 09:30:41 +07:00
Wu Zheng Hui
0f549fa113
Merge branch 'fix/fix_secure_boot_fast_wake_feature' into 'master'
...
fix(esp_system): fix ROM secure boot fast wake feature
Closes PM-625
See merge request espressif/esp-idf!44052
2025-12-16 10:24:16 +08:00
morris
827cb1b734
Merge branch 'refactor/unify_periph_clk_init' into 'master'
...
refactor(esp_system): clear dependency on hal components
Closes IDF-14844 and IDF-13980
See merge request espressif/esp-idf!43725
2025-12-16 08:58:51 +08:00
Samuel Obuch
374397c2b0
Merge branch 'fix/esp32p4_eco5_multicore_wfi_autoclock_gating' into 'master'
...
fix(esp_hw_support): enable core1 auto clock gating for esp32p4 rev3+ multicore
See merge request espressif/esp-idf!44245
2025-12-16 06:33:20 +08:00