From 7dae76b10bac4c008b6f8bb13d7f650ba8386492 Mon Sep 17 00:00:00 2001
From: yangfeng <yangfeng@espressif.com>
Date: Fri, 22 Aug 2025 12:08:48 +0800
Subject: [PATCH 1/2] fix(esp_coex): Fix the issue of uninitialized pointer
 reading in coexist_printf

---
 components/esp_coex/src/lib_printf.c | 52 ++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 components/esp_coex/src/lib_printf.c

diff --git a/components/esp_coex/src/lib_printf.c b/components/esp_coex/src/lib_printf.c
new file mode 100644
index 0000000000..a8429225b4
--- /dev/null
+++ b/components/esp_coex/src/lib_printf.c
@@ -0,0 +1,52 @@
+/*
+ * SPDX-FileCopyrightText: 2016-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @file lib_printf.c
+ *
+ * This file contains library-specific printf functions
+ * used by WiFi libraries in the `lib` directory.
+ * These function are used to catch any output which gets printed
+ * by libraries, and redirect it to ESP_LOG macros.
+ *
+ * Eventually WiFi libraries will use ESP_LOG functions internally
+ * and these definitions will be removed.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include "esp_log.h"
+#include "esp_attr.h"
+
+#define VPRINTF_STACK_BUFFER_SIZE 80
+
+static int lib_printf(const char* tag, const char* format, va_list arg)
+{
+    char temp[VPRINTF_STACK_BUFFER_SIZE];
+    int len = vsnprintf(temp, sizeof(temp) - 1, format, arg);
+    temp[sizeof(temp) - 1] = 0;
+    int i;
+    for (i = len - 1; i >= 0; --i) {
+        if (temp[i] != '\n' && temp[i] != '\r' && temp[i] != ' ') {
+            break;
+        }
+        temp[i] = 0;
+    }
+    if (i > 0) {
+        ESP_LOGI(tag, "%s", temp);
+    }
+    va_end(arg);
+    return len;
+}
+
+int coexist_printf(const char* format, ...)
+{
+    va_list arg = {};
+    va_start(arg, format);
+    int res = lib_printf("coexist", format, arg);
+    va_end(arg);
+    return res;
+}

From ad6d40de2dd48bd29e80ec04847f9f468a1a139b Mon Sep 17 00:00:00 2001
From: yangfeng <yangfeng@espressif.com>
Date: Fri, 22 Aug 2025 16:17:59 +0800
Subject: [PATCH 2/2] fix(bt/btc): Fix array compared against 0 in btc_manage.c

---
 components/bt/common/btc/core/btc_manage.c | 27 ++++++++++++----------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/components/bt/common/btc/core/btc_manage.c b/components/bt/common/btc/core/btc_manage.c
index e65e107988..4b63f1efba 100644
--- a/components/bt/common/btc/core/btc_manage.c
+++ b/components/bt/common/btc/core/btc_manage.c
@@ -8,19 +8,20 @@
 #include "btc/btc_task.h"
 #include "osi/thread.h"
 
-#if BTC_DYNAMIC_MEMORY == FALSE
-void *btc_profile_cb_tab[BTC_PID_NUM] = {};
-#else
+#if BTC_DYNAMIC_MEMORY == TRUE
 void **btc_profile_cb_tab;
+#else
+void *btc_profile_cb_tab[BTC_PID_NUM] = {};
 #endif
 
 void esp_profile_cb_reset(void)
 {
-    #if BTC_DYNAMIC_MEMORY == TRUE
-    if (btc_profile_cb_tab == NULL) {
+#if BTC_DYNAMIC_MEMORY == TRUE
+    void *p = btc_profile_cb_tab;
+    if (p == NULL) {
         return;
     }
-    #endif
+#endif
 
     int i;
 
@@ -31,11 +32,12 @@ void esp_profile_cb_reset(void)
 
 int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 {
-    #if BTC_DYNAMIC_MEMORY == TRUE
-    if (btc_profile_cb_tab == NULL) {
+#if BTC_DYNAMIC_MEMORY == TRUE
+    void *p = btc_profile_cb_tab;
+    if (p == NULL) {
         return -1;
     }
-    #endif
+#endif
 
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return -1;
@@ -48,11 +50,12 @@ int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 
 void *btc_profile_cb_get(btc_pid_t profile_id)
 {
-    #if BTC_DYNAMIC_MEMORY == TRUE
-    if (btc_profile_cb_tab == NULL) {
+#if BTC_DYNAMIC_MEMORY == TRUE
+    void *p = btc_profile_cb_tab;
+    if (p == NULL) {
         return NULL;
     }
-    #endif
+#endif
 
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return NULL;