pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bt/bluedroid): Fix index boundary check and function return in SEP registration

Browse Source 
Closes https://github.com/espressif/esp-idf/issues/18041
This commit is contained in:
yangfeng
2025-12-24 19:25:21 +08:00
parent ded4814c8d
commit cba983628d
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/bta/av/bta_av_main.c
+2 -2
View File
@@ -763,7 +763,7 @@ static void bta_av_api_reg_sep(tBTA_AV_DATA *p_data)
sep_reg.seid = p_data->api_reg_sep.seid;
sep_reg.reg_state = BTA_AV_FAIL;
if (index > BTA_AV_MAX_SEPS || p_data->hdr.layer_specific != BTA_AV_CHNL_AUDIO) {
if (index >= BTA_AV_MAX_SEPS || p_data->hdr.layer_specific != BTA_AV_CHNL_AUDIO) {
(*bta_av_cb.p_cback)(BTA_AV_SEP_REG_EVT, (tBTA_AV *)&sep_reg);
APPL_TRACE_WARNING("%s invalid parameter: seid %d, ch %d", __FUNCTION__, index, p_data->hdr.layer_specific);
return;
@@ -815,6 +815,7 @@ static void bta_av_api_reg_sep(tBTA_AV_DATA *p_data)
p_scb->seps[index].codec_type = codec_type;
p_scb->seps[index].tsep = cs.tsep;
p_scb->seps[index].p_app_data_cback = p_data->api_reg_sep.p_data_cback;
sep_reg.reg_state = BTA_AV_SUCCESS;
} else {
APPL_TRACE_WARNING("%s fail to create sep", __FUNCTION__);
break;
@@ -826,7 +827,6 @@ static void bta_av_api_reg_sep(tBTA_AV_DATA *p_data)
}
}
sep_reg.reg_state = BTA_AV_SUCCESS;
(*bta_av_cb.p_cback)(BTA_AV_SEP_REG_EVT, (tBTA_AV *)&sep_reg);
#endif
}
components/bt/host/bluedroid/btc/profile/std/a2dp/btc_av.c
+1
View File
@@ -1459,6 +1459,7 @@ static void btc_av_reg_sep(uint8_t tsep, uint8_t seid, esp_a2d_mcc_t *mcc)
param.a2d_sep_reg_stat.reg_state = ESP_A2D_SEP_REG_INVALID_STATE;
btc_a2d_cb_to_app(ESP_A2D_SEP_REG_STATE_EVT, &param);
BTC_TRACE_WARNING("%s: try to reg sep when a2dp not init or connected", __func__);
return;
}
if (mcc->type == ESP_A2D_MCT_SBC) {