a73e2e4d6c
fix(bt/bluedroid): fixed an OOB bug in btm_read_local_oob_complete
2025-12-19 16:52:31 +08:00
5a2b29fe82
fix(bt/bluedroid): fixed an OOB write in SDP_AddAttribute
2025-12-19 16:52:31 +08:00
3ec5f615ae
fix(bt/bluedroid): report failure when not able to connect to AVRCP
2025-12-19 16:52:31 +08:00
56756b1b5d
fix(bt/bluedroid): fixed buffer overflow in BRSF
2025-12-19 16:52:31 +08:00
11eea1b4de
fix(bt/bluedroid): added negative length check in process_service_search_rsp
2025-12-19 16:52:31 +08:00
be25062b0d
fix(bt/bluedroid): fixed OOB read in SDP server continuation length
2025-12-19 16:52:31 +08:00
4df287c536
fix(bt/bluedroid): added length check when copy AVDTP packet
2025-12-19 16:52:31 +08:00
6a497ad921
fix(bt/bluedroid): fixed OOB read in AT_SKIP_RESET
2025-12-19 16:52:31 +08:00
019516284f
fix(bt/bluedroid): fixed OOB write in bta_hf_client_handle_cind_list_item
2025-12-19 16:52:31 +08:00
158519cf8c
fix(bt/bluedroid): added boundary check when reading SDP attribute response packet
2025-12-19 16:52:31 +08:00
173747750d
fix(bt/bluedroid): fixed potential OOB read in the avrc_pars_vendor_rsp
2025-12-19 16:52:31 +08:00
4cb6ccc6f6
fix(bt/bluedroid): fixed potential OOB read in the reporting handler
...
Thanks to Luigino Camastra and Pavel Kohout from Aisle Research as
co-reporters for discovering and reporting this issue.
2025-12-19 16:52:31 +08:00
f15fe75f24
fix(bt/bluedroid): fixed a potential overflow about the media payload offset
...
This variable is uint16_t, and is possible to overflow when the length
of headder extension is larger. Here we compare with the data length to
prevent any exceptions.
2025-12-19 16:52:31 +08:00
15e0c748e5
fix(bt/bluedroid): fixed p_data null dereference in l2c_csm_open
2025-12-19 16:52:31 +08:00
70f82a5607
fix(bt/bluedroid): fixed Use-After-Free in btm_sec_[dis]connected
2025-12-19 16:52:31 +08:00
5b7c17cfc7
fix(bt/bluedroid): reject device with same address in legacy paring
2025-12-19 16:52:31 +08:00
0fc2109ec7
fix(bt/bluedroid): ignore AVCT commands that are too long
2025-12-19 16:52:31 +08:00
9095d1cd25
fix(bt/bluedroid): use osi_calloc to zero reserved fields in AVRCP
2025-12-19 16:52:31 +08:00
0f1c203e12
fix(bt/bluedroid): make sure SDP only start discovery once
2025-12-19 16:52:31 +08:00
1ba8aaaff8
fix(bt/bluedroid): check event ID if of register notification from remote to avoid OOB write
2025-12-19 16:52:31 +08:00
33af3a0aa6
fix(bt/blurdoird): check Classic key before cross-key derivation
2025-12-19 16:52:31 +08:00
e7e0be698a
fix(bt/blurdoird): enable bitpool snity checks
2025-12-19 16:52:31 +08:00
e0577ae677
Merge branch 'fix/fix_esp32s2_phy_issue_v55' into 'release/v5.5'
...
fix(phy): fix esp32s2 phy lib issue v55
See merge request espressif/esp-idf!44341
2025-12-18 15:48:01 +08:00
8789584388
Merge branch 'bugfix/bug_ble_max_device_record_v5.5' into 'release/v5.5'
...
fix(ble/bluedroid): Fixed BLE incorrect device record count issue (v5.5)
See merge request espressif/esp-idf!43597
2025-12-18 14:29:52 +08:00
a63ae743b1
Merge branch 'bugfix/fix_reconnect_failed_with_extend_adv_v5.5' into 'release/v5.5'
...
fix(ble/bluedroid): Fixed the issue that extend advertising might not restart if the connection fails (v5.5)
See merge request espressif/esp-idf!44251
2025-12-18 14:26:44 +08:00
5cf7ec68bc
Merge branch 'bugfix/fix_ble_security_issue_2025_v5.5' into 'release/v5.5'
...
Fix potential CVE-2024-0039 out-of-bounds write in attp_build_value_cmd (v5.5)
See merge request espressif/esp-idf!43807
2025-12-18 14:25:15 +08:00
51493f9445
Merge branch 'bugfix/fix_reattempt_sync_estab_v5.5' into 'release/v5.5'
...
fix(nimble): Add change to cancel sync in case of reattempt (v5.5)
See merge request espressif/esp-idf!43949
2025-12-18 14:21:18 +08:00
f230471ee6
Merge branch 'bugfix/fix_esp32_coex_cache_disable_crash_v5.5' into 'release/v5.5'
...
fix(coex): fix esp32 coex crash issue v5.5
See merge request espressif/esp-idf!44288
2025-12-18 14:05:52 +08:00
2a039e30d4
Merge branch 'bugfix/fix_bt_4205_v5.5' into 'release/v5.5'
...
Fixed BLE assert lld_con.c 1479 on ESP32-C3 and ESP32-S3(5106725) (v5.5)
See merge request espressif/esp-idf!44328
2025-12-18 13:59:23 +08:00
c8ba727536
fix(phy): fix esp32s2 phy lib issue
2025-12-17 20:36:28 +08:00
c4cc87501b
fix(ble/bledroid): fix codespell issues in bluedroid code
2025-12-17 17:10:58 +08:00
ebd08a5aa6
fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(5106725)
...
- Fixed BLE assert lld_con.c 1479
(cherry picked from commit 22641241faccb558353153eef06f7894c2599428)
Co-authored-by: chenjianhua <chenjianhua@espressif.com >
2025-12-17 12:53:55 +08:00
27f1484774
test(esp_flash): fixed test config that c5 not support 120MHz
2025-12-17 12:16:55 +08:00
187f43a3bb
Revert "fix(esp_system): limit CPU clock to 160MHz in ESP32-C5 for flash encryption"
...
This reverts commit 3c5d2e6b5843da853fb81067eb2bd287f7fbd735.
2025-12-17 03:33:30 +08:00
faf6cc4f84
feat(spi_flash): implement dynamic CPU frequency switching workaround for encrypted writes
...
This commit implements a workaround that allows ESP32-C5 to run at 240MHz CPU frequency
normally, while automatically reducing CPU frequency during encrypted flash writes to
ensure correct operation. The frequency limit is chip revision dependent:
- v1.2 and above: limited to 160MHz during encrypted writes
- v1.0 and below: limited to 80MHz during encrypted writes
Key implementation details:
- Frequency limiting is triggered automatically when esp_flash_write_encrypted() is called
- Uses start() flags (ESP_FLASH_START_FLAG_LIMIT_CPU_FREQ) to integrate with OS layer
- Works with both PM enabled and disabled configurations
- Frequency is automatically restored after encrypted write completes
- For ESP32-C5 with 120MHz flash, Flash clock and timing registers are adjusted when
CPU frequency is reduced to 80MHz
- SPI1 timing registers are configured during frequency switching since encrypted writes
use SPI1 and must work correctly at reduced CPU frequencies
Code improvements:
- Use SOC_MSPI_FREQ_AXI_CONSTRAINED capability macro instead of hardcoded chip checks
- Control workaround via Kconfig (CONFIG_PM_WORKAROUND_FREQ_LIMIT_ENABLED) instead of
hardcoded macros
- Add comprehensive test cases covering various PM configurations and edge cases
This workaround enables ESP32-C5 applications to benefit from 240MHz CPU performance
while maintaining reliable encrypted flash write functionality.
2025-12-17 03:33:29 +08:00
9ab736cbd1
fix(spi_flash): limit CPU clock to 160MHz for encrypted flash writes
2025-12-17 03:33:29 +08:00
3aa928d503
fix(coex): fix esp32 coex crash issue (7260f71)
2025-12-16 16:04:58 +08:00
e3d0b196c9
Merge branch 'bugfix/fix_regdma_data_race_v5.5' into 'release/v5.5'
...
fix: add mutex protection for software trigger RegDMA start to avoid data races V5.5
See merge request espressif/esp-idf!44168
2025-12-15 23:41:38 +08:00
5452adbcb9
fix(ble/bluedroid): Fixed reconnection failed with extend adv
...
(cherry picked from commit ec4052c1c7125ab1bc4223bc507e6e778d37728c)
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2025-12-15 21:23:25 +08:00
9bb7aa84fe
Merge branch 'feat/mbedtls_aes_tests_v5.5' into 'release/v5.5'
...
Only reallocate unaligned external AES and SHA buffers (v5.5)
See merge request espressif/esp-idf!44162
2025-12-15 14:25:22 +05:30
b81023c19e
bugfix(wifi): Resolve the memory corruption issue in FTM
2025-12-12 15:05:06 +05:30
11c8f6aa94
fix(mbedtls/aes): Reallocate buffers only if in external RAM
2025-12-12 13:00:40 +05:30
0f07ad18b6
fix: add mutex protection for software trigger RegDMA start to avoid data races
2025-12-11 20:32:53 +08:00
332c73b20b
Merge branch 'fix/fix_an_ot_trel_risk_v5.5' into 'release/v5.5'
...
fix(openthread): fix a potential stack overflow in TREL (v5.5)
See merge request espressif/esp-idf!43932
2025-12-11 16:42:26 +08:00
8a70704be6
fix(openthread): open nvs from the configured partition
2025-12-05 14:06:19 +08:00
acc569fd95
fix(802.15.4): fixed energy detection result
2025-12-05 12:20:23 +08:00
26e23725da
feat(openthread): Use PSRAM by default for OpenThread message buffers when PSRAM is enabled
2025-12-05 12:20:11 +08:00
74b294187d
fix(openthread): fix an error in Kconfig
2025-12-05 12:20:02 +08:00
5af377ce18
fix(openthread): resolve deadlock issues due to switching_lock
...
* esp-openthread: thread_zigbee/esp-openthread@4a650cc2f
* openthread: espressif/openthread@36b14d3ef
* esp-idf: espressif/esp-idf@871ec2c1e
2025-12-04 16:09:30 +08:00
871ec2c1ef
Merge branch 'feat/enable_lowpower_tests_for_p4_v3_v5.5' into 'release/v5.5'
...
feat: re-enable P4 pm/wakeup tests for rev3.0 (v5.5)
See merge request espressif/esp-idf!43760
2025-12-04 10:46:56 +08:00
Jin Cheng