espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-10-23 04:47:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/audio/bass: Fix parsing add source operation

Browse Source 
Check if enough data is present before parsing sub groups.
This commit is contained in:
Szymon Janc
2026-08-12 14:52:20 +05:30
committed by Rahul Tank
parent 559a8411c7
commit 0f18c6c278
1 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/audio/services/bass/src/ble_audio_svc_bass.c
+10 -9
View File
@@ -372,14 +372,15 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
*/
data_len -= offset;
for (i = 0; i < operation.add_source.num_subgroups; i++) {
if (data_len < sizeof(uint32_t)) {
/* bis_sync + metadata len */
if (data_len < (sizeof(uint32_t) + sizeof(uint8_t))) {
rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;
ev.bass_operation_status.status = BLE_HS_EREJECT;
goto done;
}
operation.add_source.subgroups[i].bis_sync_state = get_le32(&data[offset]);
offset += 4;
operation.add_source.subgroups[i].metadata_length = data[offset++];
operation.add_source.subgroups[i].metadata_length = data[offset + 4];
offset += 5;
data_len -= 5;
if (data_len < operation.add_source.subgroups[i].metadata_length) {
rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;
@@ -389,13 +390,13 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
operation.add_source.subgroups[i].metadata = &data[offset];
offset += operation.add_source.subgroups[i].metadata_length;
data_len -= operation.add_source.subgroups[i].metadata_length;
}
if (check_bis_sync(operation.add_source.num_subgroups,
operation.add_source.subgroups)) {
rc = BLE_HS_EINVAL;
ev.bass_operation_status.status = BLE_HS_EREJECT;
goto done;
}
if (check_bis_sync(operation.add_source.num_subgroups,
operation.add_source.subgroups)) {
rc = BLE_HS_EINVAL;
ev.bass_operation_status.status = BLE_HS_EREJECT;
goto done;
}
source_id_new = ble_svc_audio_bass_get_new_source_id();