Fix the high-impact issues from the code analysis report from customer.

For the CID10564,10384,10280,10098,10038,The memory was released in other place.
For the CID10365,it release the memory in the function when sent successfully.
For the CID10268,10011, we need not change the code.

components/bt/common/osi/alarm.c

@@ -143,7 +143,7 @@ static void alarm_cb_handler(struct alarm_t *alarm)
         OSI_TRACE_WARNING("%s, invalid state %d\n", __func__, alarm_state);
         return;
     }
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_alarm_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_ALARM;
@@ -173,7 +173,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
         goto end;
     }
 
-    esp_timer_create_args_t tca;
+    esp_timer_create_args_t tca = {0};
     tca.callback = (esp_timer_cb_t)alarm_cb_handler;
     tca.arg = timer_id;
     tca.dispatch_method = ESP_TIMER_TASK;

components/bt/common/osi/thread.c

@@ -110,7 +110,6 @@ static void osi_thread_stop(osi_thread_t *thread)
 osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num)
 {
     int ret;
-    osi_thread_t *thread;
     struct osi_thread_start_arg start_arg = {0};
 
     if (stack_size <= 0 ||
@@ -119,7 +118,7 @@ osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priorit
         return NULL;
     }
 
-    thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
+    osi_thread_t *thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
     if (thread == NULL) {
         goto _err;
     }

components/bt/host/bluedroid/api/esp_bt_device.c

@@ -30,7 +30,7 @@ const uint8_t *esp_bt_dev_get_address(void)
 
 esp_err_t esp_bt_dev_set_device_name(const char *name)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_dev_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -33,7 +33,7 @@ esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback)
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gap_config_adv_data(esp_ble_adv_data_t *adv_data)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -58,7 +58,7 @@ esp_err_t esp_ble_gap_config_adv_data(esp_ble_adv_data_t *adv_data)
 
 esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -77,7 +77,7 @@ esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params)
 
 esp_err_t esp_ble_gap_start_scanning(uint32_t duration)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -105,7 +105,7 @@ esp_err_t esp_ble_gap_stop_scanning(void)
 
 esp_err_t esp_ble_gap_start_advertising(esp_ble_adv_params_t *adv_params)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -134,7 +134,7 @@ esp_err_t esp_ble_gap_stop_advertising(void)
 
 esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -164,7 +164,7 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
 
 esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_data_length)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -181,7 +181,7 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_
 
 esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -209,7 +209,7 @@ esp_err_t esp_ble_gap_clear_rand_addr(void)
 
 esp_err_t esp_ble_gap_config_local_privacy (bool privacy_enable)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -225,7 +225,7 @@ esp_err_t esp_ble_gap_config_local_privacy (bool privacy_enable)
 esp_err_t esp_ble_gap_config_local_icon (uint16_t icon)
 {
     esp_err_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -304,7 +304,7 @@ esp_err_t esp_ble_gap_config_local_icon (uint16_t icon)
 
 esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda, esp_ble_wl_addr_type_t wl_addr_type)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -353,7 +353,7 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
                                                                  uint16_t min_conn_int, uint16_t max_conn_int,
                                                                  uint16_t slave_latency, uint16_t supervision_tout)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -422,7 +422,7 @@ uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *len
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_len)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -444,7 +444,7 @@ esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_l
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -461,7 +461,7 @@ esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr)
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_data_len)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -483,7 +483,7 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d
 
 esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -507,7 +507,7 @@ esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_ex
 
 esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -531,7 +531,7 @@ esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate
 
 esp_err_t esp_ble_gap_clean_duplicate_scan_exceptional_list(esp_duplicate_scan_exceptional_list_type_t list_type)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -569,7 +569,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
         }
     }
 
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -587,7 +587,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
 
 esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_act)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -604,7 +604,7 @@ esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_ac
 
 esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr, bool accept)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -622,7 +622,7 @@ esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr, bool accept)
 
 esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t passkey)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -640,7 +640,7 @@ esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t pas
 
 esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -657,7 +657,7 @@ esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept)
 
 esp_err_t esp_ble_remove_bond_device(esp_bd_addr_t bd_addr)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GAP_BLE;
@@ -704,7 +704,7 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
         return ESP_ERR_INVALID_ARG;
     }
 
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -724,7 +724,7 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
 
 esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -750,7 +750,7 @@ esp_err_t esp_ble_get_current_conn_params(esp_bd_addr_t bd_addr, esp_gap_conn_pa
 
 esp_err_t esp_gap_ble_set_channels(esp_gap_ble_channels channels)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {

components/bt/host/bluedroid/api/esp_gatt_common_api.c

@@ -1,16 +1,8 @@
-// Copyright 2015-2017 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 #include "esp_gatt_common_api.h"
@@ -31,7 +23,7 @@
  */
 esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatt_com_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

components/bt/host/bluedroid/api/esp_gattc_api.c

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 
@@ -39,7 +31,7 @@ esp_err_t esp_ble_gattc_register_callback(esp_gattc_cb_t callback)
 
 esp_err_t esp_ble_gattc_app_register(uint16_t app_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -58,7 +50,7 @@ esp_err_t esp_ble_gattc_app_register(uint16_t app_id)
 
 esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -73,7 +65,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -115,7 +107,7 @@ esp_err_t esp_ble_gattc_aux_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bd
 
 esp_err_t esp_ble_gattc_close (esp_gatt_if_t gattc_if, uint16_t conn_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -130,7 +122,7 @@ esp_err_t esp_ble_gattc_close (esp_gatt_if_t gattc_if, uint16_t conn_id)
 
 esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -145,7 +137,7 @@ esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id)
 
 esp_err_t esp_ble_gattc_search_service(esp_gatt_if_t gattc_if, uint16_t conn_id, esp_bt_uuid_t *filter_uuid)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -355,7 +347,7 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
                                    uint16_t conn_id, uint16_t handle,
                                    esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -387,7 +379,7 @@ esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
                                       esp_bt_uuid_t *uuid,
                                       esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -423,7 +415,7 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
                                       uint16_t conn_id, esp_gattc_multi_t *read_multi,
                                       esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -460,7 +452,7 @@ esp_err_t esp_ble_gattc_read_char_descr (esp_gatt_if_t gattc_if,
                                          uint16_t conn_id, uint16_t handle,
                                          esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -493,7 +485,7 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if,
                                    esp_gatt_write_type_t write_type,
                                    esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -531,7 +523,7 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if,
                                           esp_gatt_write_type_t write_type,
                                           esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -569,7 +561,7 @@ esp_err_t esp_ble_gattc_prepare_write(esp_gatt_if_t gattc_if,
                                       uint8_t *value,
                                       esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -605,7 +597,7 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if,
                                                  uint8_t *value,
                                                  esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -636,7 +628,7 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if,
 
 esp_err_t esp_ble_gattc_execute_write (esp_gatt_if_t gattc_if, uint16_t conn_id, bool is_execute)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -653,7 +645,7 @@ esp_err_t esp_ble_gattc_execute_write (esp_gatt_if_t gattc_if, uint16_t conn_id,
 esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if,
                                              esp_bd_addr_t server_bda, uint16_t handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -671,7 +663,7 @@ esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if,
 esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if,
                                                esp_bd_addr_t server_bda, uint16_t handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -687,7 +679,7 @@ esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if,
 
 esp_err_t esp_ble_gattc_cache_refresh(esp_bd_addr_t remote_bda)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -702,7 +694,7 @@ esp_err_t esp_ble_gattc_cache_refresh(esp_bd_addr_t remote_bda)
 
 esp_err_t esp_ble_gattc_cache_clean(esp_bd_addr_t remote_bda)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -717,7 +709,7 @@ esp_err_t esp_ble_gattc_cache_clean(esp_bd_addr_t remote_bda)
 
 esp_err_t esp_ble_gattc_cache_assoc(esp_gatt_if_t gattc_if, esp_bd_addr_t src_addr, esp_bd_addr_t assoc_addr, bool is_assoc)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -735,7 +727,7 @@ esp_err_t esp_ble_gattc_cache_assoc(esp_gatt_if_t gattc_if, esp_bd_addr_t src_ad
 
 esp_err_t esp_ble_gattc_cache_get_addr_list(esp_gatt_if_t gattc_if)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

components/bt/host/bluedroid/api/esp_gatts_api.c

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include "string.h"
 #include "esp_gatt_defs.h"
@@ -39,7 +31,7 @@ esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback)
 
 esp_err_t esp_ble_gatts_app_register(uint16_t app_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -60,7 +52,7 @@ esp_err_t esp_ble_gatts_app_register(uint16_t app_id)
 
 esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -76,7 +68,7 @@ esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if)
 esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
                                        esp_gatt_srvc_id_t *service_id, uint16_t num_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -96,7 +88,7 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
                                         uint8_t max_nb_attr,
                                         uint8_t srvc_inst_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -116,7 +108,7 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
 
 esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t included_service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -135,7 +127,7 @@ esp_err_t esp_ble_gatts_add_char(uint16_t service_handle,  esp_bt_uuid_t  *char_
                                  esp_gatt_perm_t perm, esp_gatt_char_prop_t property, esp_attr_value_t *char_val,
                                  esp_attr_control_t *control)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
     esp_err_t status;
 
@@ -174,7 +166,7 @@ esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
                                         esp_gatt_perm_t perm, esp_attr_value_t *char_descr_val,
                                         esp_attr_control_t *control)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
     esp_err_t status;
 
@@ -209,7 +201,7 @@ esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
 
 esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -224,7 +216,7 @@ esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle)
 
 esp_err_t esp_ble_gatts_start_service(uint16_t service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -239,7 +231,7 @@ esp_err_t esp_ble_gatts_start_service(uint16_t service_handle)
 
 esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -256,7 +248,7 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle)
 esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle,
                                       uint16_t value_len, uint8_t *value, bool need_confirm)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -290,7 +282,7 @@ esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id,
 esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id, uint32_t trans_id,
                                       esp_gatt_status_t status, esp_gatt_rsp_t *rsp)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -309,7 +301,7 @@ esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id,
 
 esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, const uint8_t *value)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -339,7 +331,7 @@ esp_gatt_status_t esp_ble_gatts_get_attr_value(uint16_t attr_handle, uint16_t *l
 
 esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, bool is_direct)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -357,7 +349,7 @@ esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, b
 
 esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -373,7 +365,7 @@ esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
 
 esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

components/bt/host/bluedroid/bta/dm/bta_dm_co.c

@@ -233,8 +233,8 @@ void bta_dm_co_loc_oob(BOOLEAN valid, BT_OCTET16 c, BT_OCTET16 r)
 *******************************************************************************/
 void bta_dm_co_rmt_oob(BD_ADDR bd_addr)
 {
-    BT_OCTET16 p_c;
-    BT_OCTET16 p_r;
+    BT_OCTET16 p_c = {0};
+    BT_OCTET16 p_r = {0};
     BOOLEAN result = FALSE;
 
 #ifdef BTIF_DM_OOB_TEST

components/bt/host/bluedroid/bta/gatt/bta_gattc_co.c

@@ -154,6 +154,10 @@ static void cacheReset(BD_ADDR bda)
             cache_env->cache_addr[index].is_open = FALSE;
         } else {
             cacheOpen(bda, false, &index);
+            if (index == INVALID_ADDR_NUM) {
+                APPL_TRACE_ERROR("%s INVALID ADDR NUM", __func__);
+                return;
+            }
             if (cache_env->cache_addr[index].is_open) {
                 nvs_erase_all(cache_env->cache_addr[index].cache_fp);
                 nvs_close(cache_env->cache_addr[index].cache_fp);

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -106,7 +106,7 @@ void btc_dm_sec_arg_deep_copy(btc_msg_t *msg, void *dst, void *src)
 
 void btc_dm_sec_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC *data)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_DM_SEC;

components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 
@@ -213,8 +205,8 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT
             if (NULL != p_elem) {
                 memcpy(p_elem++, p_elem_service_data, sizeof(tBTA_BLE_PROP_ELEM));
             }
-            osi_free(p_elem_service_data);
         }
+        osi_free(p_elem_service_data);
     }
 
     if (p_adv_data->service_uuid_len && p_adv_data->p_service_uuid) {
@@ -299,7 +291,7 @@ static void btc_adv_data_callback(tBTA_STATUS status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -318,7 +310,7 @@ static void btc_scan_rsp_data_callback(tBTA_STATUS status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -337,7 +329,7 @@ static void btc_adv_data_raw_callback(tBTA_STATUS status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -356,7 +348,7 @@ static void btc_scan_rsp_data_raw_callback(tBTA_STATUS status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -401,7 +393,7 @@ static void btc_start_adv_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -420,7 +412,7 @@ static void btc_stop_adv_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -439,7 +431,7 @@ void btc_update_duplicate_exceptional_list_callback(tBTA_STATUS status, uint8_t
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -520,7 +512,7 @@ static void btc_scan_params_callback(tGATT_IF gatt_if, tBTM_STATUS status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -559,7 +551,7 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA
 static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
 {
     esp_ble_gap_cb_param_t param;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -627,7 +619,7 @@ static void btc_start_scan_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -646,7 +638,7 @@ static void btc_stop_scan_callback(tBTA_STATUS status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -668,7 +660,7 @@ void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDA
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT;
@@ -691,7 +683,7 @@ static void btc_set_pkt_length_callback(UINT8 status, tBTM_LE_SET_PKT_DATA_LENGT
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_SET_PKT_LENGTH_COMPLETE_EVT;
@@ -711,7 +703,7 @@ static void btc_gap_ble_set_channels_cmpl_callback(void *p_data)
     tBTA_BLE_SET_CHANNELS_RESULTS *result = (tBTA_BLE_SET_CHANNELS_RESULTS *)p_data;
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_SET_CHANNELS_EVT;
@@ -731,7 +723,7 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT;
@@ -749,7 +741,7 @@ static void btc_set_rand_addr_callback(UINT8 status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     param.set_rand_addr_cmpl.status = btc_btm_status_to_esp_status(status); //todo status
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
@@ -767,7 +759,7 @@ static void btc_set_local_privacy_callback(UINT8 status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_SET_LOCAL_PRIVACY_COMPLETE_EVT;
@@ -796,7 +788,7 @@ static void btc_read_ble_rssi_cmpl_callback(void *p_data)
     tBTA_RSSI_RESULTS *result = (tBTA_RSSI_RESULTS *)p_data;
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT;

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -1,16 +1,9 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
 
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 
@@ -186,7 +179,7 @@ static void btc_gattc_free_req_data(btc_msg_t *msg)
 static void btc_gattc_cback(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
 {
     bt_status_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GATTC;

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 
@@ -297,7 +289,7 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db,
                     break;
             }
             case ESP_GATT_UUID_SEC_SERVICE:{
-                tBTA_GATT_SRVC_ID srvc_id;
+                tBTA_GATT_SRVC_ID srvc_id = {0};
                 esp_gatt_srvc_id_t        esp_srvc_id;
 
                 esp_srvc_id.id.inst_id = srvc_inst_id;
@@ -565,7 +557,7 @@ static void btc_gatts_cb_param_copy_free(btc_msg_t *msg, tBTA_GATTS *p_data)
 static void btc_gatts_inter_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 {
     bt_status_t status;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GATTS;

components/bt/host/bluedroid/stack/btm/btm_ble.c

@@ -840,7 +840,7 @@ BOOLEAN BTM_UseLeLink (BD_ADDR bd_addr)
 {
     tACL_CONN         *p;
     tBT_DEVICE_TYPE     dev_type;
-    tBLE_ADDR_TYPE      addr_type;
+    tBLE_ADDR_TYPE      addr_type = 0;
     BOOLEAN             use_le = FALSE;
 
     if ((p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR)) != NULL) {

components/bt/host/bluedroid/stack/btm/btm_devctl.c

@@ -940,7 +940,7 @@ tBTM_STATUS BTM_EnableTestMode(void)
 *******************************************************************************/
 tBTM_STATUS BTM_DeleteStoredLinkKey(BD_ADDR bd_addr, tBTM_CMPL_CB *p_cb)
 {
-    BD_ADDR local_bd_addr;
+    BD_ADDR local_bd_addr = {0};
     BOOLEAN delete_all_flag = FALSE;
 
     /* Check if the previous command is completed */

components/bt/host/bluedroid/stack/btm/btm_sec.c

@@ -1150,7 +1150,7 @@ tBTM_STATUS BTM_SecBondByTransport (BD_ADDR bd_addr, tBT_TRANSPORT transport,
 {
 #if (BLE_INCLUDED == TRUE)
     tBT_DEVICE_TYPE     dev_type;
-    tBLE_ADDR_TYPE      addr_type;
+    tBLE_ADDR_TYPE      addr_type = 0;
 
     BTM_ReadDevInfo(bd_addr, &dev_type, &addr_type);
     /* LE device, do SMP pairing */

components/bt/host/bluedroid/stack/gatt/gatt_db.c

@@ -1425,6 +1425,10 @@ static tGATT_STATUS gatts_send_app_read_request(tGATT_TCB *p_tcb, UINT8 op_code,
     UINT16   conn_id;
 
     i_rcb = gatt_sr_find_i_rcb_by_handle(handle);
+    if (i_rcb == GATT_MAX_SR_PROFILES) {
+        GATT_TRACE_ERROR("Failed to find i_rcb,Error in %s, line=%d, \n", __func__, __LINE__);
+        return (tGATT_STATUS) GATT_ERROR;
+    }
     p_sreg = &gatt_cb.sr_reg[i_rcb];
     conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_sreg->gatt_if);
 

components/bt/host/bluedroid/stack/gatt/gatt_utils.c

@@ -1399,7 +1399,7 @@ UINT8 gatt_sr_find_i_rcb_by_handle(UINT16 handle)
 **
 ** Description      The function searches for a service that owns a specific handle.
 **
-** Returns          0 if not found. Otherwise index of th eservice.
+** Returns          GATT_MAX_SR_PROFILES if not found. Otherwise index of th eservice.
 **
 *******************************************************************************/
 #if (GATTS_INCLUDED == TRUE)

components/bt/host/bluedroid/stack/l2cap/l2c_api.c

@@ -1980,6 +1980,9 @@ BOOLEAN L2CA_SetFixedChannelTout (BD_ADDR rem_bda, UINT16 fixed_cid, UINT16 idle
         transport = BT_TRANSPORT_LE;
     }
 #endif
+    if (fixed_cid<L2CAP_FIRST_FIXED_CHNL) {
+        return (FALSE);
+    }
 
     /* Is a fixed channel connected to the remote BDA ?*/
     p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, transport);

components/bt/host/bluedroid/stack/smp/smp_main.c

@@ -751,7 +751,7 @@ void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data)
             entry &= ~SMP_ALL_TBL_MASK;
             state_table = smp_all_table;
         } else {
-            state_table = smp_state_table[curr_state][p_cb->role];
+            state_table = smp_state_table[curr_state][p_cb->role ? 1 : 0];
         }
     } else {
         SMP_TRACE_DEBUG( "Ignore event [%s (%d)] in state [%s (%d)]\n",