Commit Graph

49603 Commits

Author SHA1 Message Date
Jin Cheng cb1f8d1e15 fix(bt/bluedroid): fixed an integer overflow bug in attp_build_read_multi_cmd 2025-12-16 17:37:14 +08:00
Jin Cheng e65ef0995a fix(bt/bluedroid): fixed an integer overflow bug in avdt_msg_asmbl 2025-12-16 17:37:14 +08:00
Jin Cheng e4b54ede65 fix(bt/bluedroid): fixed an OOB bug in bta_av_setconfig_rej 2025-12-16 17:37:14 +08:00
Jin Cheng 0f9b02dd95 fix(bt/bluedroid): fixed an OOB bug in btm_read_rssi_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 7a45769e25 fix(bt/bluedroid): fixed an OOB bug in btm_delete_stored_link_key_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 25b2c79269 fix(bt/bluedroid): fixed an OOB bug in btm_read_tx_power_complete 2025-12-16 17:37:14 +08:00
Jin Cheng d4c96f070c fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 1a944a4bed fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete 2025-12-16 17:37:14 +08:00
Jin Cheng 69b47952e8 fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute 2025-12-16 17:37:14 +08:00
Jin Cheng 6fe7456575 fix(bt/bluedroid): report failure when not able to connect to AVRCP 2025-12-16 17:37:14 +08:00
Jin Cheng 5ab93b428d fix(bt/bluedroid): fixed buffer overflow in BRSF 2025-12-16 17:37:14 +08:00
Jin Cheng 0638ae7177 fix(bt/bluedroid): added negative length check in process_service_search_rsp 2025-12-16 17:37:14 +08:00
Jin Cheng 7cca70cd0d fix(bt/bluedroid): fixed OOB read in SDP server continuation length 2025-12-16 17:37:14 +08:00
Jin Cheng 131a4764c8 fix(bt/bluedroid): added length check when copy AVDTP packet 2025-12-16 17:37:14 +08:00
Jin Cheng 1d8f84701c fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET 2025-12-16 17:37:14 +08:00
Jin Cheng de4339d9d1 fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item 2025-12-16 17:37:14 +08:00
Jin Cheng 439c5cc93d fix(bt/bluedroid): added boundary check when reading SDP attribute response packet 2025-12-16 17:37:14 +08:00
Jin Cheng af9d55e487 fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp 2025-12-16 17:37:13 +08:00
Jin Cheng 7706e8abbc fix(bt/bluedroid): fixed potential OOB read in the reporting handler
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-16 17:37:13 +08:00
Jin Cheng 8a44bd422d fix(bt/bluedroid): fixed a potential overflow about the media payload offset
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-16 17:37:13 +08:00
Jin Cheng c07ac874ec fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open 2025-12-16 17:37:13 +08:00
Jin Cheng 801504e152 fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected 2025-12-16 17:37:13 +08:00
Jin Cheng b898e65794 fix(bt/bluedroid): reject device with same address in legacy paring 2025-12-16 17:37:13 +08:00
Jin Cheng 49195d826f fix(bt/bluedroid): ignore AVCT commands that are too long 2025-12-16 17:37:13 +08:00
Jin Cheng 2c2162efdc fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP 2025-12-16 17:37:13 +08:00
Jin Cheng fa76f4f10a fix(bt/bluedroid): make sure SDP only start discovery once 2025-12-16 17:37:13 +08:00
Jin Cheng 86d9063aac fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write 2025-12-16 17:37:13 +08:00
Jin Cheng 9a22611e30 fix(bt/blurdoird): check Classic key before cross-key derivation 2025-12-16 17:37:13 +08:00
Jin Cheng 1a27ef6d32 fix(bt/blurdoird): enable bitpool snity checks 2025-12-16 17:37:13 +08:00
Rahul Tank f530984c90 fix(nimble): Add missing header file to fix compilation issue 2025-12-16 12:14:49 +05:30
Armando (Dou Yiwen) 5436ae6e69 Merge branch 'feature/update_esp32c5_eco3_rom_ld' into 'master'
feature(esp_rom): add esp32c5 eco3 rom ld

See merge request espressif/esp-idf!43543
2025-12-16 06:37:10 +00:00
morris 1f04dbb31b Merge branch 'refactor/remove_completed_todos' into 'master'
refactor(global): remove completed todos in the codebase

See merge request espressif/esp-idf!44188
2025-12-16 14:21:25 +08:00
nilesh.kale ef05ff039e fix(docs): alter the warning sequence for structs 2025-12-16 11:48:06 +05:30
nilesh.kale 2267558b15 feat: enabled ECDSA peripheral support for ESSP32-P4 2025-12-16 11:48:06 +05:30
nilesh.kale 361ab5d0c7 fix(hal/test_apps): moved key manager tests under flash encryption check
These two tests executed when FPGA setup is there and pass only when
flash encryption is switched on. So, this tests been moved under FE check.
2025-12-16 11:48:06 +05:30
Jiang Jiang Jian cbcc2ded3e Merge branch 'bugfix/fix_vendor_ie_issue' into 'master'
fix(wifi): fixed the vendor ie length issue

Closes WIFIBUG-1622 and WIFIBUG-1623

See merge request espressif/esp-idf!44084
2025-12-16 14:06:52 +08:00
Rahul Tank 47552ff4fd fix(protocomm): Add security checks for buffer overflow and incorrect length handling 2025-12-16 10:16:05 +05:30
Alexey Lapshin 2b94daf17f fix(esp_rom): use hmac_md5 and hmac_md5_vector from ROM only if CONFIG_LIBC_NEWLIB 2025-12-16 11:35:47 +07:00
harshal.patil bf16835aa1 test(mbedtls): Run mbedtls HW tests only if HW enabled 2025-12-16 10:05:25 +05:30
Chen Jichang 6ff2ff2c6c fix(soc): update breakpoint nums on c5 and h4 2025-12-16 12:10:56 +08:00
liuning eb882fa0eb fix(coex): fix esp32 coex crash issue (7260f71) 2025-12-16 12:04:28 +08:00
Alexey Lapshin 141d3a1653 Merge branch 'fix/signal_h_pthread_declarations' into 'master'
fix(esp_libc): add workaround for pthread_sigmask declaration in picolibc signal.h

See merge request espressif/esp-idf!44246
2025-12-16 07:56:40 +04:00
Wang Meng Yang 5104528c52 Merge branch 'bugfix/l2c_fcr_clone_buf' into 'master'
fix(bt/bluedroid): fixed possible access to NULL in l2c_fcr_clone_buf

See merge request espressif/esp-idf!44244
2025-12-16 11:50:59 +08:00
zhangyanjiao e93e827185 fix(wifi): fixed the vendor ie length issue 2025-12-16 11:22:33 +08:00
C.S.M 082219cf77 Merge branch 'fix/jpeg_com_marker_check' into 'master'
feat(jpeg_decoder): Add decode to yuv420 since esp32p4 version3

Closes IDF-14896

See merge request espressif/esp-idf!44221
2025-12-16 10:58:52 +08:00
Wan Lei 62502fbd1c Merge branch 'fix/fix_spi_master_tests' into 'master'
fix(driver_spi): fix some master test apps

Closes IDF-7503 and IDFCI-2820

See merge request espressif/esp-idf!44234
2025-12-16 10:33:02 +08:00
Alexey Lapshin 5d38af9c17 fix(esp_libc): add workaround for pthread_sigmask declaration in picolibc signal.h 2025-12-16 09:30:41 +07:00
Wu Zheng Hui 0f549fa113 Merge branch 'fix/fix_secure_boot_fast_wake_feature' into 'master'
fix(esp_system): fix ROM secure boot fast wake feature

Closes PM-625

See merge request espressif/esp-idf!44052
2025-12-16 10:24:16 +08:00
morris 827cb1b734 Merge branch 'refactor/unify_periph_clk_init' into 'master'
refactor(esp_system): clear dependency on hal components

Closes IDF-14844 and IDF-13980

See merge request espressif/esp-idf!43725
2025-12-16 08:58:51 +08:00
Samuel Obuch 374397c2b0 Merge branch 'fix/esp32p4_eco5_multicore_wfi_autoclock_gating' into 'master'
fix(esp_hw_support): enable core1 auto clock gating for esp32p4 rev3+ multicore

See merge request espressif/esp-idf!44245
2025-12-16 06:33:20 +08:00