michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: audio: Fix metadata length checks

Browse source 
This fixes metadata length checks for BT_AUDIO_METADATA_TYPE_EXTENDED
and BT_AUDIO_METADATA_TYPE_VENDOR that should be at least 2 bytes long.

Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This commit is contained in:
Mariusz Skamra 2023-06-27 14:34:41 +02:00 • committed by Carles Cufí
commit 17223f136f
7 changed files with 28 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

7
samples/bluetooth/hap_ha/src/bap_unicast_sr.c
View file

@ -290,9 +290,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}

7
samples/bluetooth/tmap_peripheral/src/bap_unicast_sr.c
View file

@ -239,9 +239,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}

7
samples/bluetooth/unicast_audio_server/src/main.c
View file

@ -431,9 +431,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}

7
subsys/bluetooth/audio/shell/bap.c
View file

@ -511,9 +511,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}

7
tests/bluetooth/tester/src/btp_bap.c
View file

@ -353,9 +353,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len, const uint8_t *data)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}

7
tests/bsim/bluetooth/audio/src/bap_unicast_server_test.c
View file

@ -182,9 +182,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}

7
tests/bsim/bluetooth/audio/src/cap_acceptor_test.c
View file

@ -347,9 +347,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
}
return true;
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
if (len < 1) {
case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
/* At least Extended Metadata Type / Company_ID should be there */
if (len < 2) {
return false;
}