From 5ca4c85497468684cc75efcc17d6f71be5466796 Mon Sep 17 00:00:00 2001
From: baohongde <baohongde@espressif.com>
Date: Mon, 20 Jan 2020 11:32:26 +0800
Subject: [PATCH] components/bt: Fix connection fail and crash when receive
 unknown AT cmd

---
 .../bluedroid/api/include/api/esp_hf_ag_api.h     |  3 ++-
 .../bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c   | 15 +++++++++++++--
 .../bluedroid/classic_bt/hfp_ag/main/bt_app_hf.c  |  2 +-
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/components/bt/host/bluedroid/api/include/api/esp_hf_ag_api.h b/components/bt/host/bluedroid/api/include/api/esp_hf_ag_api.h
index bdfa3db00..f8d6011d8 100644
--- a/components/bt/host/bluedroid/api/include/api/esp_hf_ag_api.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_hf_ag_api.h
@@ -335,7 +335,8 @@ esp_err_t esp_bt_hf_volume_control(esp_bd_addr_t remote_bda, esp_hf_volume_contr
  *                  As a precondition to use this API, Service Level Connection shall exist between AG and HF Client.
  *
  * @param[in]       remote_addr: remote bluetooth device address
- * @param[in]       unat: AT command string from HF Client
+ * @param[in]       unat: User AT command response to HF Client.
+ *                        It will response "ERROR" by default if unat is NULL.
  * @return
  *                  - ESP_OK: disconnect request is sent to lower layer
  *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
index d7a2821c1..3fa04aea4 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
@@ -461,12 +461,18 @@ static bt_status_t btc_hf_unat_response(bt_bdaddr_t *bd_addr, const char *unat)
         return BT_STATUS_FAIL;
     }
 
-    if (is_connected(NULL) && (idx != BTC_HF_INVALID_IDX))
+    if (is_connected(bd_addr) && (idx != BTC_HF_INVALID_IDX))
     {
         tBTA_AG_RES_DATA    ag_res;
         /* Format the response and send */
         memset(&ag_res, 0, sizeof(ag_res));
-        strncpy(ag_res.str, unat, BTA_AG_AT_MAX_LEN);
+        if (unat != NULL) {
+            strncpy(ag_res.str, unat, BTA_AG_AT_MAX_LEN);
+        } else {
+            ag_res.ok_flag = BTA_AG_OK_ERROR;
+            ag_res.errcode = BTA_AG_ERR_OP_NOT_SUPPORTED;
+        }
+
         BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_UNAT_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
@@ -878,6 +884,10 @@ void btc_hf_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     switch (msg->act) {
         case BTC_HF_UNAT_RESPONSE_EVT:
         {
+            if (src->unat_rep.unat == NULL) {
+                break;
+            }
+
             dst->unat_rep.unat = (char *)osi_malloc(strlen(src->unat_rep.unat)+1);
             if(dst->unat_rep.unat) {
                 memcpy(dst->unat_rep.unat, src->unat_rep.unat, strlen(src->unat_rep.unat)+1);
@@ -1066,6 +1076,7 @@ void btc_hf_call_handler(btc_msg_t *msg)
         case BTC_HF_UNAT_RESPONSE_EVT:
         {
             btc_hf_unat_response(&arg->unat_rep.remote_addr, arg->unat_rep.unat);
+            break;
         }
 
         case BTC_HF_CME_ERR_EVT:
diff --git a/examples/bluetooth/bluedroid/classic_bt/hfp_ag/main/bt_app_hf.c b/examples/bluetooth/bluedroid/classic_bt/hfp_ag/main/bt_app_hf.c
index 022807bca..557791c5f 100644
--- a/examples/bluetooth/bluedroid/classic_bt/hfp_ag/main/bt_app_hf.c
+++ b/examples/bluetooth/bluedroid/classic_bt/hfp_ag/main/bt_app_hf.c
@@ -190,7 +190,7 @@ void bt_app_hf_cb(esp_hf_cb_event_t event, esp_hf_cb_param_t *param)
         case ESP_HF_UNAT_RESPONSE_EVT:
         {
             ESP_LOGI(BT_HF_TAG, "--UNKOW AT CMD: %s", param->unat_rep.unat);
-            esp_hf_unat_response(hf_peer_addr, param->unat_rep.unat);
+            esp_hf_unat_response(hf_peer_addr, NULL);
             break;
         }