pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed an OOB bug in btm_create_conn_cancel_complete

Browse Source
This commit is contained in:
Jin Cheng
2025-10-11 19:15:35 +08:00
parent a73e2e4d6c
commit 08a593d801
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/stack/btm/btm_sec.c
+7 -2
View File
@@ -2753,11 +2753,16 @@ static void btm_sec_bond_cancel_complete (void)
** Returns void
**
*******************************************************************************/
void btm_create_conn_cancel_complete (UINT8 *p)
void btm_create_conn_cancel_complete (UINT8 *p, UINT16 evt_len)
{
UINT8 status;
STREAM_TO_UINT8 (status, p);
if (evt_len >= 1) {
STREAM_TO_UINT8 (status, p);
} else {
BTM_TRACE_ERROR("%s malformatted event packet, too short", __func__);
status = BTM_ERR_PROCESSING;
}
//BTM_TRACE_EVENT ("btm_create_conn_cancel_complete(): in State: %s status:%d\n",
// btm_pair_state_descr(btm_cb.pairing_state), status);
components/bt/host/bluedroid/stack/btm/include/btm_int.h
+1 -1
View File
@@ -1215,7 +1215,7 @@ tBTM_STATUS btm_sec_mx_access_request (BD_ADDR bd_addr, UINT16 psm, BOOLEAN is_
UINT32 mx_proto_id, UINT32 mx_chan_id,
tBTM_SEC_CALLBACK *p_callback, void *p_ref_data);
void btm_sec_conn_req (UINT8 *bda, UINT8 *dc);
void btm_create_conn_cancel_complete (UINT8 *p);
void btm_create_conn_cancel_complete (UINT8 *p, UINT16 evt_len);
void btm_read_linq_tx_power_complete (UINT8 *p);
void btm_sec_init (UINT8 sec_mode);
components/bt/host/bluedroid/stack/btu/btu_hcif.c
+1 -1
View File
@@ -1163,7 +1163,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
break;
#if (CLASSIC_BT_INCLUDED == TRUE)
case HCI_CREATE_CONNECTION_CANCEL:
btm_create_conn_cancel_complete(p);
btm_create_conn_cancel_complete(p, evt_len);
break;
#endif // #if (CLASSIC_BT_INCLUDED == TRUE)
case HCI_READ_LOCAL_OOB_DATA: