From 8a014c33c0898f27bf2309d84725ef52f36bc59c Mon Sep 17 00:00:00 2001
From: Zhou Xiao <zhouxiao@espressif.com>
Date: Fri, 23 May 2025 12:29:46 +0800
Subject: [PATCH] fix(ble): fixed printf va list cross function pass failure

---
 .../bt/common/ble_log/ble_log_spi_out.c       | 40 ++++++++++++++-----
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/components/bt/common/ble_log/ble_log_spi_out.c b/components/bt/common/ble_log/ble_log_spi_out.c
index ca190516c9..cbbb5447e6 100644
--- a/components/bt/common/ble_log/ble_log_spi_out.c
+++ b/components/bt/common/ble_log/ble_log_spi_out.c
@@ -183,7 +183,7 @@ static void spi_out_log_flush(void);
 static int spi_out_ul_log_init(void);
 static void spi_out_ul_log_deinit(void);
 static void spi_out_ul_log_write(uint8_t source, const uint8_t *addr, uint16_t len, bool with_ts);
-static bool spi_out_ul_log_printf(uint8_t source, const char *format, va_list args);
+static bool spi_out_ul_log_printf(uint8_t source, const char *format, va_list args, int offset);
 
 #if SPI_OUT_LL_ENABLED
 static int spi_out_ll_log_init(void);
@@ -589,12 +589,14 @@ static void spi_out_ul_log_write(uint8_t source, const uint8_t *addr, uint16_t l
     spi_out_log_cb_write_loss(ul_log_cb);
 }
 
-static bool spi_out_ul_log_printf(uint8_t source, const char *format, va_list args)
+static bool spi_out_ul_log_printf(uint8_t source, const char *format, va_list args, int offset)
 {
-    int len = vsnprintf((char *)ul_log_str_buf, SPI_OUT_UL_LOG_STR_BUF_SIZE, format, args);
+    int len = vsnprintf((char *)(ul_log_str_buf + offset),
+                        SPI_OUT_UL_LOG_STR_BUF_SIZE - offset, format, args);
     if (len < 0) {
         return false;
     }
+    len += offset;
 
     // Truncate string if overflowed
     if (len >= SPI_OUT_UL_LOG_STR_BUF_SIZE) {
@@ -1103,16 +1105,23 @@ int ble_log_spi_out_printf(uint8_t source, const char *format, ...)
         return -1;
     }
 
+    if (!format) {
+        return -1;
+    }
+
     // Get arguments
     va_list args;
     va_start(args, format);
 
+    va_list args_copy;
+    va_copy(args_copy, args);
+
     xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
-    bool ret = spi_out_ul_log_printf(source, format, args);
+    bool ret = spi_out_ul_log_printf(source, format, args_copy, 0);
     xSemaphoreGive(ul_log_mutex);
 
+    va_end(args_copy);
     va_end(args);
-
     return ret? 0: -1;
 }
 
@@ -1122,18 +1131,29 @@ int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, c
         return -1;
     }
 
+    if (!tag || !format) {
+        return -1;
+    }
+
     va_list args;
     va_start(args, format);
 
+    va_list args_copy;
+    va_copy(args_copy, args);
+
     // Create log prefix in the format: "[level][tag] "
+    bool ret = false;
     xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
-    snprintf((char *)ul_log_str_buf, SPI_OUT_UL_LOG_STR_BUF_SIZE,
-             "[%d][%s] %s", level, tag? tag: "NULL", format);
-    bool ret = spi_out_ul_log_printf(source, (const char *)ul_log_str_buf, args);
+    int prefix_len = snprintf((char *)ul_log_str_buf, SPI_OUT_UL_LOG_STR_BUF_SIZE,
+                              "[%d][%s]", level, tag? tag: "NULL");
+    if ((prefix_len < 0) || (prefix_len >= SPI_OUT_UL_LOG_STR_BUF_SIZE)) {
+        goto exit;
+    }
+    ret = spi_out_ul_log_printf(source, format, args_copy, prefix_len);
+exit:
     xSemaphoreGive(ul_log_mutex);
-
+    va_end(args_copy);
     va_end(args);
-
     return ret? 0: -1;
 }