espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-10-18 03:07:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/audio/bass: Fix Modify Source operation PDU parsing

Browse Source 
Num_Subgroups is 1 byte so adjust accordingly. Also validate received
data while parising it. In case of error reject operation.
This commit is contained in:
Szymon Janc
2026-08-12 14:52:20 +05:30
committed by Rahul Tank
parent 0f18c6c278
commit 41e2f26b86
2 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h
+1 -1
View File
@@ -325,7 +325,7 @@ struct ble_svc_audio_bass_operation {
uint16_t pa_interval; uint16_t pa_interval;
/** Number of subgroups */ /** Number of subgroups */
uint16_t num_subgroups; uint8_t num_subgroups;
/** Subgroup entries */ /** Subgroup entries */
struct ble_svc_audio_bass_subgroup struct ble_svc_audio_bass_subgroup
nimble/host/audio/services/bass/src/ble_audio_svc_bass.c
+15 -6
View File
@@ -516,20 +516,29 @@ ble_svc_audio_bass_modify_source(uint8_t *data, uint16_t data_len, uint16_t conn
operation.modify_source.pa_interval = get_le16(&data[offset]); operation.modify_source.pa_interval = get_le16(&data[offset]);
offset += 2; offset += 2;
operation.modify_source.num_subgroups = get_le16(&data[offset]); operation.modify_source.num_subgroups = data[offset++];
offset += 2;
data_len -= offset; if (operation.modify_source.num_subgroups > BLE_SVC_AUDIO_BASS_SUB_NUM_MAX) {
if (data_len < operation.modify_source.num_subgroups * sizeof(uint32_t)) {
rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;
ev.bass_operation_status.status = BLE_HS_EREJECT; ev.bass_operation_status.status = BLE_HS_EREJECT;
goto done; goto done;
} }
data_len -= offset;
/**
* Previous data was checked for it's size in `ble_svc_audio_bass_ctrl_point_write_access`.
* As bis_sync_state array may be of variable length, we need to check it separately
*/
for (i = 0; i < operation.modify_source.num_subgroups; i++) { for (i = 0; i < operation.modify_source.num_subgroups; i++) {
/* bis_sync + metadata len */
if (data_len < (sizeof(uint32_t) + sizeof(uint8_t))) {
rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;
ev.bass_operation_status.status = BLE_HS_EREJECT;
goto done;
}
operation.modify_source.subgroups[i].bis_sync_state = get_le32(&data[offset]); operation.modify_source.subgroups[i].bis_sync_state = get_le32(&data[offset]);
offset += 4; operation.modify_source.subgroups[i].metadata_length = data[offset + 4];
operation.modify_source.subgroups[i].metadata_length = data[offset++]; offset += 5;
data_len -= 5; data_len -= 5;
if (data_len < operation.modify_source.subgroups[i].metadata_length) { if (data_len < operation.modify_source.subgroups[i].metadata_length) {
rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;