Skip to content

Commit a928656

Browse files
committed
fix(ble/bluedroid): Fix potential uint32_t overflow in BLE btu_start_timer
1 parent 6becf74 commit a928656

File tree

9 files changed

+14
-11
lines changed

9 files changed

+14
-11
lines changed

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1850,7 +1850,8 @@ esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params);
18501850
/**
18511851
* @brief This procedure keep the device scanning the peer device which advertising on the air
18521852
*
1853-
* @param[in] duration: Keeping the scanning time, the unit is second.
1853+
* @param[in] duration: The scanning duration in seconds.
1854+
* Set to 0 for continuous scanning until explicitly stopped.
18541855
*
18551856
* @return
18561857
* - ESP_OK : success

components/bt/host/bluedroid/stack/btu/btu_task.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -453,7 +453,7 @@ void btu_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout_sec)
453453
// NOTE: This value is in seconds but stored in a ticks field.
454454
p_tle->ticks = timeout_sec;
455455
p_tle->in_use = TRUE;
456-
osi_alarm_set(alarm, (period_ms_t)(timeout_sec * 1000));
456+
osi_alarm_set(alarm, (period_ms_t)((period_ms_t)timeout_sec * 1000));
457457
}
458458

459459

examples/bluetooth/bluedroid/ble/ble_eddystone_receiver/main/esp_eddystone_demo.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t* par
8484
switch(event)
8585
{
8686
case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
87+
// the unit of the duration is second, 0 means scan permanently
8788
uint32_t duration = 0;
8889
esp_ble_gap_start_scanning(duration);
8990
break;

examples/bluetooth/bluedroid/ble/ble_ibeacon/main/ibeacon_demo.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
7373
}
7474
case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
7575
#if (IBEACON_MODE == IBEACON_RECEIVER)
76-
//the unit of the duration is second, 0 means scan permanently
76+
// the unit of the duration is second, 0 means scan permanently
7777
uint32_t duration = 0;
7878
esp_ble_gap_start_scanning(duration);
7979
#endif

examples/bluetooth/bluedroid/ble/ble_spp_client/main/spp_client_demo.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Unlicense OR CC0-1.0
55
*/
@@ -216,9 +216,8 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
216216
ESP_LOGE(GATTC_TAG, "Scan param set failed: %s", esp_err_to_name(err));
217217
break;
218218
}
219-
//the unit of the duration is second
220-
uint32_t duration = 0xFFFF;
221-
ESP_LOGI(GATTC_TAG, "Enable Ble Scan:during time %04" PRIx32 " minutes.",duration);
219+
// the unit of the duration is second, 0 means scan permanently
220+
uint32_t duration = 0;
222221
esp_ble_gap_start_scanning(duration);
223222
break;
224223
}

examples/bluetooth/bluedroid/ble/gatt_client/main/gattc_demo.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,9 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
328328
uint8_t adv_name_len = 0;
329329
switch (event) {
330330
case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
331-
//the unit of the duration is second
331+
// The unit of duration is seconds.
332+
// If duration is set to 0, scanning will continue indefinitely
333+
// until esp_ble_gap_stop_scanning is explicitly called.
332334
uint32_t duration = 30;
333335
esp_ble_gap_start_scanning(duration);
334336
break;

examples/bluetooth/bluedroid/ble/gatt_security_client/main/example_ble_sec_gattc_demo.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -385,7 +385,7 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
385385
}
386386
break;
387387
case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
388-
//the unit of the duration is second
388+
// the unit of the duration is second, 0 means scan permanently
389389
uint32_t duration = 30;
390390
esp_ble_gap_start_scanning(duration);
391391
break;

examples/bluetooth/bluedroid/ble/gattc_multi_connect/main/gattc_multi_connect.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -775,7 +775,7 @@ static void esp_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *par
775775
param->update_conn_params.timeout);
776776
break;
777777
case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
778-
//the unit of the duration is second
778+
// the unit of the duration is second, 0 means scan permanently
779779
uint32_t duration = 30;
780780
esp_ble_gap_start_scanning(duration);
781781
break;

examples/bluetooth/bluedroid/coex/gattc_gatts_coex/main/gattc_gatts_coex.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param
278278
break;
279279
case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
280280
ESP_LOGI(COEX_TAG, "ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT, set scan sparameters complete");
281-
//the unit of the duration is second
281+
// the unit of the duration is second, 0 means scan permanently
282282
uint32_t duration = 120;
283283
esp_ble_gap_start_scanning(duration);
284284
break;

0 commit comments

Comments
 (0)