From 185b4d9d44133a10b7d038bb4f5a94e75b96c7c9 Mon Sep 17 00:00:00 2001
From: Jin Cheng <JinCheng@espressif.com>
Date: Tue, 3 Dec 2024 17:53:40 +0800
Subject: [PATCH] fix(bt/bluedroid): fixed access NULL in HFP callback handler

---
 .../btc/profile/std/hf_ag/btc_hf_ag.c         | 50 ++++++++++++-------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
index caa900e85a..d4d597dfdd 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
@@ -316,12 +316,17 @@ bt_status_t btc_hf_init(void)
 {
     int idx = 0;
 
-    if (hf_local_param[idx].btc_hf_cb.initialized) {
-        esp_hf_cb_param_t param = {
-            .prof_stat.state = ESP_HF_INIT_ALREADY,
-        };
-        btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
-        return BT_STATUS_SUCCESS;
+#if HFP_DYNAMIC_MEMORY == TRUE
+    if (hf_local_param)
+#endif
+    {
+        if (hf_local_param[idx].btc_hf_cb.initialized) {
+            esp_hf_cb_param_t param = {
+                .prof_stat.state = ESP_HF_INIT_ALREADY,
+            };
+            btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
+            return BT_STATUS_SUCCESS;
+        }
     }
 
     BTC_TRACE_DEBUG("%s - max_hf_clients=%d", __func__, btc_max_hf_clients);
@@ -364,12 +369,18 @@ void btc_hf_deinit(void)
     BTC_TRACE_EVENT("%s", __FUNCTION__);
 
     int idx = 0;
-    if (!hf_local_param[idx].btc_hf_cb.initialized) {
-        esp_hf_cb_param_t param = {
-            .prof_stat.state = ESP_HF_DEINIT_ALREADY,
-        };
-        btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
-        return;
+
+#if HFP_DYNAMIC_MEMORY == TRUE
+    if (hf_local_param)
+#endif
+    {
+        if (!hf_local_param[idx].btc_hf_cb.initialized) {
+            esp_hf_cb_param_t param = {
+                .prof_stat.state = ESP_HF_DEINIT_ALREADY,
+            };
+            btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
+            return;
+        }
     }
 
     btc_dm_disable_service(BTA_HFP_SERVICE_ID);
@@ -1285,12 +1296,17 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         case BTA_AG_DISABLE_EVT:
         {
             idx = 0;
-            btc_hf_cb_release();
-            if (hf_local_param[idx].btc_hf_cb.initialized) {
-                param.prof_stat.state = ESP_HF_DEINIT_SUCCESS;
-                btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
+#if HFP_DYNAMIC_MEMORY == TRUE
+            if (hf_local_param)
+#endif
+            {
+                if (hf_local_param[idx].btc_hf_cb.initialized) {
+                    hf_local_param[idx].btc_hf_cb.initialized = false;
+                    btc_hf_cb_release();
+                    param.prof_stat.state = ESP_HF_DEINIT_SUCCESS;
+                    btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
+                }
             }
-            hf_local_param[idx].btc_hf_cb.initialized = false;
             break;
         }
         case BTA_AG_REGISTER_EVT: